THE BIG DEAL Taiwan’s Ministry of Digital Affairs confirmed on 13 August that government agencies were hit in July by a campaign in which open-source AI agents did most of the work. Researchers at Dream recovered the attackers’ archive: over four days from 1 July, up to eight parallel agents mapped 21 systems, harvested usernames from an unauthenticated API, solved CAPTCHAs, guessed passwords derived from staff identifiers and cracked 85 accounts. They took more than 2,564 personnel records, six database credentials and seven single sign-on secrets, then moved on to the nuclear safety agency and seven energy companies. Everything taken was stored in readable form. The agents needed no exploit, only machine-speed patience.
TAKEAWAY Machine-speed attackers exhaust weak controls in hours, so the data must survive the perimeter’s failure. Encrypt personnel records and credentials at rest, vault every secret, and assume that anything an unauthenticated API returns is already in an adversary’s hands.
You cannot monitor what you haven’t mapped. You cannot protect what you haven’t found. DISCOVER is step one of the GuardWare data-first security sequence. INSIGHT monitors everything including AI. PROTECT encrypts every sensitive file, so data that leaves your environment is worthless to anyone without your keys.
Related Blogs
Eight Agents, Four Days: AI Runs a Government Intrusion in Taiwan
Closer to Home: Origin Energy’s Breach Traced to a Manila Call Centre
284 Million Rows in Four Days: McKesson’s Cloud Warehouses Emptied
How an SME Built a Security Posture That Enterprise Clients Trust
What If Your Data Could Protect Itself? A Data-First Security Playbook
Payment Security Summit & Gala – Australia 2026
Do you know where your sensitive data is?
Stop your IP and Design files from being stolen?
