According to an iThome report on October 22, 2026, Kemao Biotechnology (科懋生技) stated that an external-facing system operated by its outsourced e-commerce platform vendor suffered an automated attack in which the order database was scraped [1]. Affected data includes personal information of some Kemao Mall online members, and Kemao preliminarily assessed no material impact on operations [1]. Kemao has notified competent authorities, required the outsourced vendor to implement improvements and continuous monitoring, and issued anti-fraud reminders via its official website, member app, and SMS [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
MediumMonitoringMedia reported
Kemao Biotechnology Mall Member Data Scraped Following Automated Attack on Outsourced Vendor System
1 min read
- Disclosed
- Oct 22, 2026
- Published
- Nov 8, 2026
- Last updated
- Nov 7, 2026
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Healthcare
What to do nowOur advice
Kemao has notified competent authorities, required the outsourced vendor to implement improvements and continuous monitoring, and issued anti-fraud reminders via its official website, member app, and SMS [1].
Timeline
- iThome reports on Kemao's same-day material cybersecurity filing[1]
Technical details
What Happened
According to iThome, Kemao Biotechnology issued a material information filing on October 22, 2026 stating that after receiving member reports of personal data exposure, an investigation found that an external-facing service system of its outsourced online sales platform vendor had been hit by an automated attack, resulting in the scraping of its online order database [1].
Scope of Impact
The report noted that part of the scraped data involved personal information of Kemao Mall members; the company preliminarily assessed no material impact on operations and had not received any compensation claims from members at the time [1].
Response Measures
Kemao contacted the outsourced vendor, convened an emergency response meeting, implemented notification and protective measures, reported the incident to competent authorities, and required the vendor to remediate the issue and strengthen monitoring; the company continues to distribute anti-scam warnings via its website, Facebook page, member app, and SMS [1].
References
Media1
- [1]
“上櫃生技醫療公司科懋（6496）於10月22日發布資安事件重大訊息，指出接獲線上會員反映個資外洩，調查後發現公司產品線上銷售平臺的系統服務委外廠商，其對外服務系統遭到自動化攻擊，線上訂單資料庫遭到擷取，其中部分涉及科懋商城線上會員的個人資料。”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.