Skip to content
NewA calmer, faster ZeroHour
Data breachhighExploited in the wild

AI-Powered BOSSAI Attacks Exposed Patient Records in Taiwan

Original title: AI-Powered BOSSAI Attacks Expose Patient Records and Emergency Dispatch Data in Taiwan

GBHackersby Mayura Kathir ()3 min read2
Read at gbhackers.com
Part of a story covered by 3 sourcesOne Taiwan operator’s BOSSAI agents confirmed at about 10 targetsMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

A single operator ran a twelve-agent AI mesh that breached emergency services across eleven countries.

Acronis identified a mesh of twelve AI agents operated by one individual in Taiwan that scanned and exploited targets in eleven countries. It exposed ECG readings, vital signs and dispatch records from a Taipei fire department platform dating to 2018. Agents also harvested student data from Thai universities and Mexican phone records. The platform used open-weight models including DeepSeek-V4.

Key facts
  • Targeted emergency medical and dispatch systems
  • Exposed data back to 2018 from public API
  • Campaign hit universities and banks in eleven countries
  • Single operator identified by Acronis TRU
  • Agents enumerated subdomains and ran exploits
Security assessment · AI, from the articleExploited in the wild

Impact: exposure of patient medical records and emergency dispatch data

What to do
  1. 1.Isolate exposed medical data platforms
  2. 2.Monitor for AI agent scanning
  3. 3.Review legacy API exposures
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Tags
ai-attacksdata-breachtaiwa
Victims
Taipei fire departmentcity 119 dispatch systemThai universitiesMexican organizations
Organizations
Acronis
Countries
TaiwanThailandMexico
AI models
DeepSeek-V4

Indicators of compromise

auto-extracted · verify before use · export allAll
TypeIndicatorContext
domainc.xs1.ccwu.cc37.136 Domain vps.xs1.ccwu.cc Domain xss.xs1.ccwu.cc Domain c.xs1.ccwu.cc Note: IP addresses and domains are intentionally defanged (
domainvps.xs1.ccwu.ccIP address 156.240.109.26 IP address 49.158.237.136 Domain vps.xs1.ccwu.cc Domain xss.xs1.ccwu.cc Domain c.xs1.ccwu.cc Note: IP addres
domainxss.xs1.ccwu.cc.26 IP address 49.158.237.136 Domain vps.xs1.ccwu.cc Domain xss.xs1.ccwu.cc Domain c.xs1.ccwu.cc Note: IP addresses and domains are int
ipv4112.121.185.218r rapid, automated scanning. IOCs Type Indicator IP address 112.121.185.218 IP address 156.240.109.26 IP address 49.158.237.136 Domain
ipv4156.240.109.26. IOCs Type Indicator IP address 112.121.185.218 IP address 156.240.109.26 IP address 49.158.237.136 Domain vps.xs1.ccwu.cc Domain xss
ipv449.158.237.136ddress 112.121.185.218 IP address 156.240.109.26 IP address 49.158.237.136 Domain vps.xs1.ccwu.cc Domain xss.xs1.ccwu.cc Domain c.xs1.

From the original article

3 min read at gbhackers.com

BOSSAI, an agentic attack platform run by one operator that exposed emergency medical and dispatch data in Taipei. The campaign targeted hundreds of organizations in eleven countries, including emergency services, banks, universities, military systems and e-commerce sites. Confirmed breaches hit universities and emergency providers, with medical data and PII exfiltrated.

GBHackers

By Mayura Kathir · gbhackers.com

Read the full article at GBHackers

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.