A new chapter in the global cybersecurity landscape is shaking Taiwan. According to threat intelligence (CTI) monitoring reports, an actor identified as Gorz Rostam has allegedly posted a list of 36 purported databases belonging to Taiwanese entities, including judicial bodies, educational institutions, universities, tech companies, financial entities, and chambers of commerce.
The term CTI (Cyber Threat Intelligence) refers to the collection and analysis of information about digital threats, aiming to anticipate and mitigate potential attacks. In this case, the alert was raised by monitoring teams tracking activities on the dark web, a portion of the internet not indexed by conventional search engines and often used for illicit activities.
What Do We Know So Far?
The publication by Gorz Rostam, whose origin and motivations have not yet been officially verified, would include a list of databases that could contain sensitive information about Taiwanese citizens and organizations. Among the sectors mentioned are:
- Justice: possible judicial and administrative records.
- Education and universities: data on students, faculty, and academic staff.
- Technology: information from companies in the sector, one of Taiwan's most relevant industries.
- Finance: potential client and transaction data.
- Commerce: records from chambers of commerce and businesses.
So far, the authenticity of the data has not been confirmed, nor has it been verified whether the databases were actually stolen or if this is a speculative list. Taiwanese authorities have not issued an official statement, and local Computer Security Incident Response Teams (CSIRTs) are reportedly assessing the situation.
Context: Taiwan in the Crosshairs of Cyberattacks
Taiwan has historically been one of the most attacked countries in cyberspace, due to its geopolitical relevance and its key role in the global technology supply chain. Companies like TSMC, the world's largest semiconductor manufacturer, have been targeted by intrusion attempts on multiple occasions. According to reports from Taiwan's National Security Agency, cyberattacks against critical infrastructure and government agencies have increased significantly in recent years.
Publishing lists of databases on the dark web is a common tactic among threat actors, who seek to sell the information or use it as a pressure tool. In many cases, the lists are just a preview of what could come: the sale of full data to interested buyers, who could use it for financial fraud, espionage, or targeted phishing campaigns.
What Does This Mean for Citizens and Businesses?
While the news is alarming, experts recommend staying calm and taking preventive measures. If the data is real, those affected could face risks such as:
- Identity theft.
- Financial fraud.
- Personalized phishing attacks.
- Leakage of confidential information.
Companies and organizations mentioned in the list should review their access logs and security audits, as well as notify users if a breach is confirmed. For their part, Taiwanese citizens might consider changing passwords and enabling two-factor authentication on their most sensitive accounts.
Security Recommendations
In light of such incidents, cybersecurity specialists suggest:
- Monitor bank and financial accounts for unusual activity.
- Do not click on suspicious links received via email or messaging.
- Use unique passwords for each service and change them periodically.
- Stay informed through official sources and incident response channels.
The situation is still developing, and more details are expected to emerge in the coming hours or days about the veracity of the list and the real scope of the potential leak. Meanwhile, the international cybersecurity community remains on alert, and Taiwan is strengthening its digital defenses against a threat that, if confirmed, would mark a new milestone in the escalation of attacks against the island.
Source: threat intelligence reports and dark web monitoring. Information under verification.