Acronis attributes Taipei emergency dispatch theft to Taiwan-based BOSSAI operator

In November 2026, Acronis Threat Research Unit said a single attacker based in Taiwan used BOSSAI AI agents to take emergency dispatch records from seven districts in Taipei. The researchers said the AI agents found an unauthenticated fire department platform in Taipei holding patient records from 2018, among them electrocardiogram readings and ambulance video, with no login required.

Acronis analysts expressed high confidence that one person in Hualien City, Taiwan, carried out the intrusion, and the attribution rested on reused identity elements including a GitHub profile, logo, SSH key name, and e-mail address. The operator configured 12 AI agents in the BOSSAI framework and actively used nine of them during the campaign, and the main attack agent, Hermes, handled about 95 sessions and 18,311 messages, 83.5% of which were direct tool calls and results.

Hermes cycled through at least nine models in 19 days. The agent eventually settled on an abliterated DeepSeek-V4 variant named DS4 that ran on local GPUs with a 64K context window.

The operator used local versions of DeepSeek, GLM, and Qwen that had safety alignments removed, while commercial models including Grok and MiniMax M3 turned down malicious instructions and asked for written proof of authorization. Grok was the single exception, repairing a broken proof-of-concept script that the attacker then gave to an attack agent.

The agents never messaged each other directly, and the operator served as the bridge by pasting one agent’s output into another. Cloud models performed most of the building work, and Grok served as the main builder.

The mesh reached testing tools through MCP servers, which let agents connect to external tools, such as HexStrike AI, a Kali Linux server, and a Ghidra bridge. The number of MCP servers reached a high of 13 before the operator reduced the group to three.

Investigators recovered over 90,000 files from the attacker’s server. The evidence totaled 9GB and included command histories, agent dialogues, hacking tools, credentials, and stolen victim information.

In Mexico, the agents collected about 206,800 residential phone records with names and addresses using government statistics and telecom sources. A different directory-scraping effort in Mexico brought together roughly 124,000 records.

In Thailand, agents examined 489 targets spread across 45 universities and took data from three of them. At one Thai university, an agent opened an administrative database table with 2,563 rows and attempted to extract student data. Verified injection flaws existed at two additional Thai universities without any confirmed data theft.

Researchers examining the platform identified targets in at least eight additional countries that were only scanned or placed in a queue and never executed. The city’s 119 emergency system API supplied the stolen dispatch records. They included street-level locations, case status, response types, and incident times, and they were case records instead of live ambulance or GPS tracking.

Defensive controls stopped the agents when systems required logins, valid sessions for paywalls, or properly filtered endpoints. The main attack agent reported results that researchers later determined had not occurred. A scanning tool in the mesh invented CVEs, and more than half of its high- and critical-severity findings were false positives or wrongly classified.

Agents entered a Taiwanese fire-dispatch vendor’s database administration panel using default root credentials. An emergency-management system’s frontend JavaScript contained a hard-coded AES-256 key that exposed session cookies, including an administrator’s identity. Researchers found an incomplete server-side request-forgery route, but no full compromise occurred.

Weakly protected assets included a medical data port that had been open since 2018 and dispatch records available on a public-facing API. Elsewhere, a lender had 16 SQL injection points, and universities operated unpatched Oracle databases.

The operator issued commands in Traditional Chinese, typing them mainly straight into each agent’s interface. Attack traffic exited the mesh through proxy layers, and the main node ran on a server at 112[.]121[.]185[.]218.

Nine IP addresses and nine domains in Acronis’s list tie to the attacker’s setup, none marked active or inactive and most without notes on their use. Researchers observed the operation across 12 days and captured one recorded exchange of the attacker working on July 25.

According to researchers, the attacker probably wanted to make money, and whether he works for anyone is unclear. Attacks against government, emergency, and military targets sometimes looked like the work of state-backed hacking groups and sometimes resembled ordinary cybercrime.

Taiwan experienced heavier targeting than any other country. About 10 targets across Taiwan, Mexico, and Thailand suffered confirmed compromise during a 12-day observation, while roughly 15 more targets faced attacks without confirmed compromise.

Researchers did not say whether affected organizations or Taiwan’s authorities received notification, or whether exposed data remains accessible. The summary says breaches led to stolen medical and personal data, while the detailed Taipei patient-platform account says only that the platform exposed records.