TOM Group (02383): Investigations into the data security incident are still ongoing

According to Zhitong Finance App News, TOM Group (02383) issued an announcement. On or around September 8, 2026, the group detected a cyber attack on its servers located in Taiwan. These servers provided services to the “Business Weekly” department of Chengbang Cultural Services Co., Ltd., the main subsidiary of the company. The cyber attack resulted in the encryption of several data held by the Group's servers in Taiwan, China. On September 9, 2026, the data security incident extended to Hong Kong, China, and affected the Group's servers in Hong Kong, China. As a result, some data held by the Group's servers in Hong Kong, China was encrypted.

After the data security incident was discovered, the Group immediately isolated and disconnected all affected systems located in Taiwan and Hong Kong, China from the Internet to prevent further spread of the cyber attack. The Group has appointed cybersecurity experts and consulting firms to (i) assist in investigating the cause and scope of the data security incident; (ii) assess the integrity of the Group's data; and (iii) review the security of the Group's information systems.

As of the date of this announcement, investigations are ongoing, and it has not been possible to determine whether the data security incident caused any data or data leakage or loss, and (if so) the extent of the leak or loss. The Group will take further action as appropriate after the investigation has been completed. The Group is working closely with cybersecurity experts and consulting firms to advance the investigation. The Group is conducting a comprehensive assessment of the impact of the data security incident on its business and operations. The Group attaches great importance to data security and will continue to strengthen its information system security measures to do its best to prevent similar incidents in the future. The Group will also provide further updates in due course.

Furthermore, as of the date of this announcement, the Group has notified the relevant authorities in Taiwan, China and Hong Kong of this data security incident. The Group will continue to assess its legal and regulatory responsibilities to further inform other relevant authorities if necessary, and will promptly cooperate with the relevant authorities' investigations.