BOSSAI AI-agent campaign: Taipei 119 dispatch records taken, fire-department patient data exposed
Severity: high · Patch status: no-fix-needed · Since 2026-11-04
Acronis Threat Research Unit's report (published 2026-11-04) describes BOSSAI, a mesh of 12 AI agents (nine active during the investigation) run by one operator that the report assesses with high confidence to be based in Hualien City, Taiwan. The operator targeted hundreds of organizations in eleven countries; the report counts roughly 10 with confirmed data exfiltration or system access, across three countries (not named), and about 15 more attacked without confirmed compromise. In Taiwan, agents pulled case records (incident times, response types, status fields, street-level locations) for seven Taipei districts from a city 119 dispatch system's API, and found a fire-department patient-care platform that exposed medical data dated 2018 (ECG readings, ambulance video, vital signs) without credentials. The offensive agents ran almost exclusively on abliterated (safety-removed) variants of DeepSeek, GLM and Qwen, used after commercial models refused offensive work; the report says those models were less effective and error-prone. SQL injection with data extraction was confirmed at a Taiwanese lender and at three Thai universities. In Mexico the operator compiled about 206,800 residential phone records (names, addresses, postal codes) for three cities and 12 neighbourhoods from a pipeline drawing on government statistical, postal and telecommunications-authority data; the report does not say this came from one breached organization. Attribution is the report's high-confidence assessment, built from the operator's own infrastructure (an open directory on one VPS; more than 90,000 files and 9 GB is the total evidence set) and reused handles, branding and SSH-key identity. No vendor patch is involved: the exposures came from unauthenticated endpoints, default credentials, a hardcoded key in front-end JavaScript and unpatched Oracle databases. The report does not say whether victims were notified or fixed.
What to do
- Audit public-facing APIs and admin panels for unauthenticated access and default credentials
- Remove hardcoded keys/secrets from front-end JavaScript
- Remediate SQL injection points and patch databases (e.g., unpatched Oracle instances)
- Enforce authentication, session validation, and endpoint filtering on sensitive services
- Monitor for the reported attacker IOCs (9 IPs, 9 domains)
Sources
All live incidents on Threat Watch
