BOSSAI campaign extracts emergency-service and university data using AI-assisted attacks

Acronis describes a campaign operated through twelve configured AI agents, nine active during its investigation. The operator manually relayed results between agents; it was not an autonomous agent-to-agent network. Commercial models mainly helped build infrastructure and repeatedly refused explicit attacks, while the offensive work largely used locally run models with safety alignment removed. This is misuse of tools, not evidence that their vendors’ platforms were breached.

The most serious reported exposure involved a Taipei emergency patient-care platform serving medical records from 2018 only, including ECG readings, ambulance video and vital signs without credentials. A separate 119 dispatch API yielded incident times, response types, status and street-level locations across seven Taipei districts. These were case records, not live ambulance GPS tracking. A default-root database login exposed at least eighteen tables at a dispatch technology vendor; an attempted webshell against that vendor failed.

At Thai universities, Acronis reports data extraction at three institutions. One yielded a 2,563-row administrator table, while its student-data dump was only attempted; other universities had confirmed student/table extraction. These are the researcher’s findings, not independently verified person counts. Its approximately 206,800 Mexican residential-phone records and separate roughly 124,000 yellow-pages records came from aggregation/scraping and must not be added as distinct breach victims.

Acronis also reports account-table extraction through sixteen SQL-injection points at a Taiwanese lending-services firm and a demonstrated incorrect-CVV acceptance issue in a mobile-payment provider’s card-binding flow. The latter does not establish completed unauthorized card charges. These are additional reported findings, not evidence that every targeted financial institution was breached.

The report estimates roughly ten targets with confirmed system access or exfiltration across three countries and about fifteen additional actively attacked targets without confirmed compromise. Broader targeting reached eleven countries, including reconnaissance and staged work; some queued targets saw no attack traffic. The tool even fabricated a critical Apache finding that was later rejected. There is no published campaign-wide CVE, victim-person total or completed recovery statement. The confirmed sensitive-data access supports the serious rating; neither every scanned organization nor every claimed vulnerability is confirmed compromised.

Acronis attributes the operation to one Taiwan-based individual through recovered configuration and infrastructure overlaps. That assessment does not establish state sponsorship, an arrest, or a connection to WorkOS/ARTEX or other AI-assisted incidents.