Ransomware attacks surge in Taiwan with AI-enhanced tactics
Taiwan's Cyber Security Administration warned that ransomware attacks have escalated significantly, with attackers using generative AI to enhance phishing campaigns and employ 'double extortion' tactics. At least 12 Taiwanese enterprises across manufacturing, healthcare, and technology sectors reported attacks in 2025 and early 2026.
What happened
Taiwan's Cyber Security Administration warned on 27 July 2026 that ransomware attacks have escalated, with hackers increasingly using generative AI to create realistic phishing emails and automate attacks with greater precision.
Attack methods have evolved from simple file encryption to 'double extortion' tactics, where attackers steal sensitive data and threaten to publicly disclose it, compounding pressure on victims even when backups exist.
According to the administration, ransomware typically enters systems through phishing emails, malicious websites, system vulnerabilities, or illegal software, with manufacturing, service, and healthcare sectors as primary targets.
Reported impact
In 2025, at least 7 named Taiwanese enterprises and medical institutions publicly disclosed ransomware attacks across healthcare, electronic components, automotive parts, pharmaceuticals, and plastics manufacturing sectors.
As of 22 July 2026, at least 5 additional enterprises publicly disclosed attacks in paper, biotech manufacturing, semiconductor equipment, and electronic components industries.
Victims face potential data loss, service interruption, financial losses, and reputational damage.
Index analysis
The administration noted that hackers are increasingly organized along industrial and specialized lines, making attacks more sophisticated.
Generative AI development has enabled attackers to rapidly produce convincing phishing lures and social engineering baits, significantly increasing attack precision and scale.
Governance controls
The administration recommended four core protective measures: implement system backups using the '3-2-1 principle' (3 copies, 2 media types, 1 offsite); maintain updates to operating systems, applications, and antivirus software; strengthen password security with minimum 15-character passwords, multi-factor authentication, and password managers; and raise awareness of suspicious messages and links.
The administration advised victims to immediately disconnect networks, avoid paying ransom, preserve evidence, seek expert assistance, report to police and Taiwan's Computer Security Incident Response Center (TWCERT/CC), and replace account credentials before rebuilding systems.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.