APAC breach record
When the breach arrived as a file
Publicly documented incidents across APAC where the initial access or payload delivery was a file: a weaponised document, a malicious attachment, an infected upload or transfer.
Validated events only. Every entry cites the public record, and every prevention statement is conditional analysis of the vector class, bounded by what Glasswall actually claims.
Most recent
Latest documented events
The most recent file-borne events across the region. The full record is on the regional timeline.
-
GO2 Health: Phishing email opened a Brisbane clinic's main mailbox to an attacker
The main reception mailbox at the Everton Park practice was accessed in April 2026. Because the mailbox auto archives, exposure was confined to twelve months of correspondence, which included some patients' Department of Veterans Affairs identification numbers, medical history and referrals; the primary patient records system was not reached. The regulator was notified in May and patients in July 2026, and no evidence of publication or misuse was reported.
The documented vector. Phishing email that led to compromise of the practice's main mailbox. The practice's own statement says it became aware of unauthorised access to one of its email mailboxes via a phishing email, and engaged external experts to investigate and contain the incident. The statement does not specify what the message carried, and this entry does not fill that in.
How this class of vector is removed
The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. The practice reported the compromise of a shared clinical mailbox, where mail reaching a busy reception desk is exactly the case processing on the mail path is meant to cover.
Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- healthcare
-
Hutt City Council: A phishing email actioned by staff turned council mailboxes into an attack platform
The March 2026 compromise was disclosed in a council report in April 2026. Five individuals had identity information compromised and 732 people may have had financial information exposed through email correspondence. The council reported the incident to the Office of the Privacy Commissioner and tightened security settings, monitoring and staff training; it declined a public records request for the full incident report.
The documented vector. Phishing email actioned by a staff member, leading to takeover of several mailboxes. The council's incident report, as reported to its audit and risk subcommittee, records that the attack originated from a staff member responding to a phishing email, which gave attackers access to a small number of email accounts. Those accounts were then used to send further malicious email internally and externally.
How this class of vector is removed
The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. What the council's account does establish is that compromised mailboxes then sent further malicious mail internally, and mail arriving from a genuine internal sender is processed exactly as anything else is, because the control does not consult sender reputation.
Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- government
-
Japan Ground Self-Defense Force: Counterfeit USB sticks carried malware onto more than 50 defence computers
The devices were in use from April 2024 until the infection was confirmed in February 2025, and were connected to more than 50 computers, nearly half of them closed systems handling classified command and control information. Detection was accidental, after a soldier noticed a machine running slowly. The Ministry of Defense states the malware was limited to self propagation with no exfiltration or external communication, and no data loss has been confirmed. Procurement records were not retained, so the supply route is unestablished. The incident surfaced publicly in June 2026 and was answered in the Diet that July.
The documented vector. Counterfeit USB memory devices carrying self propagating malware from manufacture. Answers to written questions in the House of Councillors record that internal rules were not observed and no computer virus scan was carried out to confirm the safety of the USB memory before use, and that the devices bore the name of a company located in China. Six sticks, sold as one terabyte but built from cheap microSD, were malware bearing at manufacture.
Note on this entry
The record documents code that ran when a device was mounted, rather than content submitted through any control point, and the parliamentary answer's finding is the striking part: the inspection step the rules required was never performed across ten months of use. It is carried here for that. No prevention analysis is published for it.
- defence
Source: House of Councillors, National Diet of Japan · Source: House of Councillors, National Diet of Japan
-
Customers of Japanese online brokerages (FSA record): Phishing sites impersonating brokerages drove 19,000 customer account takeovers and hundreds of billions of yen in unauthorised trades
From January 2025 the Financial Services Agency has published monthly counts of unauthorised access and unauthorised trading in customer accounts at Japanese online brokerages. To July 2026 the cumulative totals reached 19,142 unauthorised accesses and 10,607 unauthorised trades, with roughly 436.5 billion yen of sales and 383.5 billion yen of purchases executed in hijacked customer accounts; April 2025 alone accounted for 5,490 accesses. The credentials were taken from customers on sites impersonating their brokers rather than from the brokerages' own systems. Customers of eighteen firms were affected at the peak, most of which have agreed compensation schemes, and the Metropolitan Police made the first arrests in November 2025.
The documented vector. Emails and messages impersonating brokerages such as Rakuten Securities, Nomura Securities, Daiwa Securities and SBI Securities, and their partners, carrying links to credential harvesting sites; information-stealing malware also documented. The Financial Services Agency's record names no firm: it describes customer information stolen through fake websites built to look like real securities firms, and through malware. The brands named here are the ones impersonated, and the accounts taken over belonged to those firms' retail customers. The impersonated firms' own notices name the vector. Nomura describes cases where fake emails impersonating Nomura or its partners lure victims to phishing sites and steal account numbers and passwords. Daiwa describes emails and messages with a spoofed sender that make the recipient click an embedded link leading to a fake website.
Note on this entry
The record documents links to credential harvesting sites: what the reader was asked to do was type an account number and password into a web page built to look like their broker. No file was delivered in that path, and the accounts in this wave belonged largely to retail customers reading mail outside any corporate boundary, so we make no prevention claim for this event.
- banking
Source: Financial Services Agency · Source: Financial Services Agency · Source: Nomura Securities · Source: Daiwa Securities
-
Casio Computer Co., Ltd.: Ransomware and data leak the company's report attributed to deficiencies in its anti-phishing measures
Ransomware deployed on Casio's servers on 5 October 2024 by the group calling itself Underground leaked personal data of 8,478 employees, business partners and some customers, alongside internal documents. Casio published its final investigation report on 7 January 2025, attributing the intrusion by a sophisticated overseas attacker to partial deficiencies in its phishing email countermeasures and its global network security arrangements.
The documented vector. Phishing email, per the company's final investigation report; mechanism not further specified. Casio's published final report on the incident attributes entry to gaps the investigation found in the company's phishing email countermeasures and global network security. The report frames the cause through the control rather than narrating the specific message, and this entry reflects that.
How this class of vector is removed
The record names phishing as the route but not what the message carried. Inbound mail is processed before it reaches anyone rather than trusted on the strength of its sender, and a carried document is rebuilt to its format's known good specification, which is what this class of vector usually turns on and does not depend on the reader spotting anything. The record does not establish what arrived, so this is held at low confidence. The company's report identifies gaps in its phishing email countermeasures rather than narrating the message itself.
Email CDR RelayContent Disarm and ReconstructionGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- manufacturing
Southeast Asia
Southeast Asia territories
2 documented events
Philippines
The Philippine privacy regulator publishes resolutions that name the mechanism, and two of them document files: malicious Excel attachments that opened a cruise operator's network, and a credential harvesting file mailed to 387 recipients.
2 documented events
Singapore
Singapore's record pairs the country's largest breach, SingHealth, whose Committee of Inquiry traced entry to a phishing email carrying malicious code, with the 2019 ST Logistics incident, where the regulator's published decision names the exact malicious .doc attachment.
Oceania
Oceania territories
5 documented events
Australia
Australia documents breach vectors in court rather than in press releases: the regulators' filings against FIIG Securities, RI Advice and Australian Clinical Labs each name the file or the email, and the university at the centre of the 2018 ANU breach published its own attack chain.
2 documented events
New Zealand
New Zealand's largest health-sector cyber attack, the 2021 Waikato District Health Board ransomware incident, was publicly attributed by the board itself to an email attachment as the initial incursion.
East Asia
East Asia territories
15 documented events
Japan
Japan has the region's richest documented record: eight events from the 2015 Japan Pension Service intrusion to the 2024 DMM Bitcoin theft and the KADOKAWA and Casio ransomware disclosures, most documented by official investigations or the affected organisations' own published reports.
4 documented events
South Korea
Korea's record runs from prosecutor-documented weaponised HWP documents at a nuclear operator to the privacy regulator's recent penalties over malicious files uploaded straight through web upload functions, including a decision issued in August 2026.
2 documented events
Taiwan
Taiwan's record runs from the 2016 First Commercial Bank ATM heist, traced by investigators to a spear-phishing email, to D-Link's own 2023 confirmation that a phished employee was the route into its systems.
Method
What qualifies an event
Three tests, applied strictly, and events that fail any of them are excluded rather than stretched.
Validated. The event is documented by a regulator statement, an official inquiry or prosecutor report, the affected organisation's own disclosure, or reputable press with named confirmation. Every entry carries its sources.
File-borne. The public record documents that initial access or payload delivery travelled as a file: a malicious document or archive, a macro attachment, an infected upload or file transfer, removable media, or the email itself, since a message carrying malicious code or a deceptive hyperlink is a file crossing your boundary. Credential attacks and pure network exploits do not appear here.
Mappable. The vector belongs to a class of content that a named Glasswall capability processes. The analysis states how that class of vector is removed. It does not claim to know what the affected organisation ran, and it does not assign blame.
That third test excludes a whole category we could otherwise have listed. Invoice fraud, where a convincing message asks a finance team to change a supplier's bank details, arrives by email and is documented in police statements across the region. We leave it out because the deception there is in the instruction rather than in the file, which makes it a different problem from the one this record is about.
Scope
About these pages
Every event on this page meets three tests before it is published. It is documented by reliable public sources: a regulator, an official inquiry, the affected organisation's own disclosure, or reputable press with named confirmation, and each entry links to those sources. The initial access or payload delivery travelled as a file, as the public record states it. And where an entry carries a prevention analysis, that analysis is bounded by what we can evidence; where an entry carries none, that is deliberate.
About the organisations named here. They are named because the public record names them, and for no other reason. Nothing on this page alleges fault, negligence or any breach of duty by any organisation or individual, and nothing here should be read as saying that anyone acted improperly or that their security arrangements were inadequate. Being attacked is not evidence of either, and the organisations on this page include some of the most heavily defended in the region. We summarise what published sources report and link to them so you can read them yourself. We have not independently investigated any incident and we hold no non-public information about any of them. Names are used to identify the organisations concerned; no affiliation with them, and no endorsement by them, is implied, and all trade marks remain their owners'.
About the prevention analysis. Where an entry describes how a class of vector is addressed, that is a general statement about how a control treats that class of content. It is not a claim that our products were in use, that they would have been deployed in that architecture, or that they would have prevented that incident. It is not an assessment of any organisation's actual controls, which we do not know. What a control achieves in practice depends on configuration, deployment and file type. Where an entry carries no prevention analysis, we are making no claim about that event either way.
Generally. This page is a working reference, not an incident report, a security assessment or legal advice, and it is provided without warranty. Details reflect the public record on the review date and may have changed since. If you believe anything here is inaccurate, incomplete or out of date, tell us and we will review it promptly and correct it where the record supports that.