netiCRM Vendor Suffers Cyberattack; Over 30 Taiwan NGOs Issue Anti-Fraud Warnings

More than 30 Taiwanese non-profit organizations issued fraud warnings between November 9 and 10 following a cyberattack on netiCRM, a donor and supporter management system operated by NetsBridge. According to an announcement by the Taiwan Tongzhi Hotline Association and media reports, an attacker obtained credentials for the internal code management system and exploited a vulnerability to gain administrative server access at 1:55 AM on November 9. The vendor severed the connection around 3:30 AM, patched the flaw, updated keys and passwords, and reported the incident to the Ministry of Digital Affairs and police. The Hotline stated that the vendor does not store credit card details. NetsBridge stated that the compromised machine was an internal technical management server rather than the database hosting donation records, and no evidence of stolen donor records has yet been identified. However, client admin credentials are treated as potentially exposed out of caution, with users advised to update passwords. In response, groups like the Citizen Congress Watch preemptively paused online donation services.

Key takeaways

• NetsBridge internal management servers were breached at 1:55 AM on November 9; the vendor severed unauthorized access around 3:30 AM, patched flaws, and updated system keys.
• Over 30 Taiwanese NGOs using netiCRM issued alerts to donors, with some temporarily suspending online forms as a precaution.
• The vendor reported the incident to authorities, clarified credit cards are not stored, and is investigating whether donor records were affected.