CSIST procurement system breached via hidden developer interface

The Chungshan Institute of Science and Technology (CSIST) is undergoing a review following a cybersecurity breach of its procurement system. On August 28, the system began sending hundreds of outdated procurement notices to suppliers.

While CSIST initially attributed the incident to an AI security-testing tool exceeding its permissions, subsequent investigations revealed that the system's developer had hidden a task-management interface. This interface was breached via an overseas IP address, allowing hackers to trigger scheduled commands that prompted the mass distribution of notices.

Minister of National Defense Wellington Koo has ordered a comprehensive review and a determination of responsibility regarding the management failure. CSIST acknowledged a management gap caused by failing to conduct a retrospective review of the system—built in March 2019—in accordance with Software Bill of Materials (SBOM) policies. The institute has since demanded a complete SBOM from the vendor and is implementing new security measures, including abnormal information dispatch alerts and automated service suspension protocols.