ReadingResearchRadarInvestment frameworkAI Company Primary Sources
Sign in / Sign up
← Back to reading
NewsMaterial4 min readDisconfirmAI Editorial

91APP CISO Lin Dawei: Past Success in Tracking Data Leaks Slowed Down This Investigation

Taiwanese e-commerce SaaS provider 91APP held a press conference on October 29 to release a 25-day investigation report into the hacking incident. Chief Information Security Officer (CISO) Lin Dawei explained that it took 11 days from the initial breach to confirming the attack trajectory because the team's past successful experience prioritized checking external nodes, whereas this intrusion occurred within internal systems. 91APP also outlined three major improvement directions—implementing a zero-trust architecture, AI-driven detection, and external expert assessments—to address the speed challenges posed by AI automation attack tools such as ARTEX.

2026-10-29 21:00 GMT+8

Taiwanese e-commerce SaaS provider 91APP held a press conference on October 29, 2026, to release the "91APP Hacking Incident: 25-Day Investigation Report." Chairman Ho Ying-chi led company executives to apologize to affected consumers and brand clients. 91APP stated that due to the inability to confirm exactly which orders were involved, based on the maximum possible scope of impact, the incident affects 1,329 brands and 4,798,225 consumers. The information potentially accessed includes names, phone numbers, delivery addresses, email addresses, and order records, but does not include passwords, credit card details, or other payment data.

Beyond the scale of the impact, the investigation process of this incident is also noteworthy. 91APP was breached on October 3, and the following day, brands reported that consumers had received suspected phishing messages. However, the attack trajectory and vulnerability were not confirmed until October 14, with the breach blocked that same night. Why did it take 11 days from the initial breach to confirming the source of the intrusion? 91APP CISO Lin Dawei reconstructed this investigation process at the press conference.

Lin Dawei admitted that the prolonged investigation was related to the initial direction taken. He explained that an e-commerce order passes through multiple nodes, including the brand's operational computers, the order management system, and the 91APP platform itself. In the past, when investigating suspected order data leaks, the team habitually prioritized checking external nodes, a method that had proven effective over the years; thus, the same approach was used this time. However, the actual source of the intrusion was located within 91APP's internal systems. The team only grasped the attack trajectory after subsequently expanding the investigation to the internal environment. Lin Dawei acknowledged that the initial investigation direction was incorrect and that both internal and external environments should have been checked simultaneously from the start, rather than focusing primarily on external nodes.

Sign in / Sign up
ReadingResearchRadarInvestment frameworkAI Company Primary Sources

According to the joint investigation by 91APP and Aoyi Smart Technology, attackers entered 91APP's internal network through an unpatched internal efficiency tool, Appsmith, and then obtained database keys from the code management platform GitLab, thereby illegally accessing an order database within Commerce Cloud. 91APP noted that the investigation found traces related to the ARTEX AI automated attack tool and attributed this incident to automated attacks using such tools. This incident not only involved third-party tools that were not updated in a timely manner but also included the issue of attackers gaining further access to databases after obtaining internal keys. 91APP stated in its investigation report that the failure of protection and patch management to keep pace with the speed of attacks is an area the company must reflect upon.

In response to this incident, 91APP stated that it has removed the exploited tools, changed system keys and passwords, readjusted GitLab permissions, isolated test and production environments, and restricted network connections between hosts and databases. Regarding future protection, 91APP proposed three major improvement directions: First, to promote a Zero Trust architecture by implementing micro-segmentation of networks and applications, enforcing least privilege, and conducting continuous verification to reduce the scope of access between different systems and lower the risk of lateral movement by attackers within the internal network. Second, to utilize AI to accelerate security detection and response speeds by continuously monitoring for anomalies, analyzing them, and automatically responding via AI, while also using AI to simulate attacks and proactively identify system vulnerabilities. Third, to introduce external security experts for continuous assessment, leveraging third-party independent testing, evaluation, and threat intelligence sharing to supplement potential blind spots in the internal perspective.

Lin Dawei pointed out that automated tools allow attackers to find intrusion paths faster, making traditional periodic protection operations difficult to respond to in time. This comparison reveals the speed gap between automated attacks and manual responses: when attackers use AI tools to accelerate vulnerability discovery and path planning, defense systems relying on regular scans and manual investigations suffer from structural delays. 91APP's investigation experience also illustrates that past successful models can themselves become cognitive anchors, causing teams to stick to old paths when facing new attack vectors, only breaking the deadlock after external experts intervene.

Regarding subsequent consumer handling, 91APP has notified brands within the affected scope and expects to proactively notify potentially affected consumers starting November 2, once brand authorization is obtained, while uniformly accepting inquiries and compensation applications. According to 91APP, consumers can apply for compensation regardless of whether they have already suffered financial losses. However, the actual scale of fraud-related financial losses, the total compensation amount, and the specific compensation methods for those without financial losses are still under investigation and have not yet been determined.

Sources

  • techorange.comTechOrange 科技報橘↗
Continue researching →