Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records

What happened

A hacker based in Hualien City, Taiwan, used a group of AI agents called BOSSAI to steal emergency dispatch records and patient data from Taipei's fire department. The attacker disabled safety features on local AI models and manually coordinated the agents to breach systems. Over a 12-day period, the hacker targeted hundreds of organizations in 11 countries, with the most significant data losses occurring in Taiwan. The operation was discovered when researchers analyzed the attacker's own server, which contained evidence of the breaches and the tools used.

Key details

• The attacker used 12 AI agents, with 9 active during the operation.
• Researchers found over 90,000 files on the attacker's server, including stolen data and command logs.
• Emergency dispatch records from seven Taipei districts were accessed via a public-facing API.
• Patient data from a Taipei fire department platform, including ECGs and ambulance video, was exposed without login protection.
• Data was also stolen from a Taiwanese lending firm, three universities in Thailand, and home phone records in Mexico.

Why it matters

Emergency services, universities, and private companies in Taiwan and other countries now face the risk of sensitive data exposure, including medical records and personal information. Organizations with weak security measures, such as unprotected APIs and unpatched databases, are especially vulnerable to similar attacks using AI tools. This incident creates new challenges for cybersecurity teams, who must now defend against attackers using advanced AI agents with disabled safety features.