Bank SinoPac New Online Banking Unauthorized Transfers: Hackers Exploit Vendor Security Configuration Flaw; NT$41.76M Across 418 Customers Transferred and Refunded

What Happened

On the evening of November 4, Bank SinoPac explained that the unauthorized customer account transfers on November 3 resulted from external hackers exploiting a security configuration flaw in its new online banking transaction system supplier, noting that no other financial institution in Taiwan has adopted that specific transaction system ^[4].

Scope of Impact

Preliminary findings identified 427 abnormal transactions of approximately NT$100,000 each; all affected customers held National ID numbers starting with the letter P, and the bank stated that hackers used a specific method to randomly probe for valid accounts rather than relying on pre-existing leaked personal data ^[1][3]. All affected funds were fully refunded on November 3 ^[5].

Response

The bank has blocked the attack vector, strengthened authentication controls, enhanced abnormal transaction monitoring, notified regulators and law enforcement agencies, and shared threat intelligence with financial peers via F-ISAC; the Taipei District Prosecutors Office has opened an investigation into offenses against computer security ^[1][3].