Taiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch Records

What happened

A hacker based in Taiwan used BOSSAI AI agents to steal sensitive emergency dispatch records covering seven districts of Taipei. Researchers at Acronis’s Threat Research Unit identified the breach last week. The AI agents not only extracted call logs but also discovered a Taipei fire department platform exposing patient data from 2018. This included electrocardiogram readings and even ambulance video footage, all accessible without any login or authentication. The research team is confident the attack was carried out by a single individual leveraging the AI agents.

The risk

The attack exploits AI-driven automation to scale reconnaissance, exploitation, and data extraction on critical public safety infrastructure. Emergency dispatch records and patient medical data are highly sensitive and, if exposed, can compromise personal privacy, operational security, and public trust. Unprotected access to ambulance footage and ECG data increases risks of identity theft and blackmail, while leaking emergency response details can hamper security planning and emergency preparedness. This breach exposes how AI can amplify attacker reach and efficiency against poorly secured government systems.

Why it matters

Public safety agencies are prime targets and often rely on legacy or lightly protected systems. This incident forces operators to re-evaluate their cybersecurity postures, especially concerning AI-assisted attackers that continuously scan for vulnerabilities at scale. It pressures governments and agencies to implement stringent access controls and monitoring to prevent unauthorized data exposure. For broader operators, it signals that AI is not just a productivity tool but also a force multiplier for hackers, increasing attack sophistication without needing large teams.

Who should pay attention

Emergency services, healthcare IT operators, and public sector cybersecurity teams should take a hard look at their data access environments. AI security researchers and incident responders must prepare for evolving tactics using autonomous AI agents. Vendors supplying software for emergency dispatch and medical records should prioritize airtight authentication and continuous auditing. Policy makers need to consider regulations that mandate minimum cybersecurity hygiene levels for public health and safety systems.

What to watch next

Look for follow-up reports on whether Taiwanese authorities tighten controls on emergency dispatch platforms and patient data repositories. Track how cybersecurity vendors respond with AI-driven defense mechanisms designed to detect and block other AI-powered attacks. Observe any regulatory changes or mandates emerging in public sector cybersecurity governance, especially relating to AI’s role in threat automation. Lastly, see if attackers adopt similar AI hacking methods globally, pushing other regions to elevate their defenses.

AI Quick Briefs Editorial Desk