Acronis report: Taiwanese hacker used BOSSAI agents to steal Taipei emergency dispatch records

Acronis Threat Research Unit reports that an attacker believed to be located in Hualien City, Taiwan, operated a network of AI agents named BOSSAI (12 agents, 9 put into use), attacking hundreds of organizations in at least 11 countries and stealing dispatch records covering seven districts from the API of Taipei's 119 emergency dispatch system, including incident times, response types and street-level locations. The agents also found a platform of the Taipei fire department that has been accessible without login since 2018, exposing ECG readings and ambulance video; the attacks succeeded against about 10 organizations in Taiwan, Mexico and Thailand, including about 206,800 residential phone records containing names and addresses in Mexico and data from three universities in Thailand. Commercial models mostly refused to assist with the attacks; Grok and MiniMax M3 both refused when directly asked to attack, so the attack agents ran almost entirely on locally hosted abliterated models with safety training removed (modified versions of DeepSeek, GLM and Qwen).