1. 【平台資安】全球9000校陷危！學習平台Canvas遭駭 2.75億人資料恐外洩
- 摘要：全球超過 9,000 所學校使用的學習管理平台 Canvas 驚傳遭駭客入侵，恐導致高達 2.75 億名師生的個人資料與學習紀錄外洩。
- 建議行動：若有註冊或使用外部 Canvas 平台相關服務，請立即更改密碼，並切勿與校內公務信箱或單一入口使用相同密碼。
- 參考連結： 學習平台Canvas遭駭 (MSN 新聞)
2. 【防詐快訊】報稅季釣魚信出沒！假冒內政部誆稱未更新憑證無法報稅
- 摘要：詐騙集團趁 5 月報稅季，假冒內政部憑證管理中心寄發電子郵件，以「緊急安全更新通知」等理由誆稱不更新自然人憑證將無法報稅，藉此騙取民眾個資。
- 建議行動：報稅相關通知請一律以財政部或內政部官方網站公告為準。切勿點擊信件內的不明連結或下載附檔，若有疑慮請直撥 165 反詐騙專線查證。
- 參考連結： 報稅季釣魚信出沒 (自由時報)
3. 【企業資安】市占第一OTP簡訊平臺EVERY8D遭駭，F-ISAC發布警訊
- 摘要：國內市占第一的 OTP 簡訊平台 EVERY8D 遭駭客攻擊，金融資安資訊分享與分析中心（F-ISAC）已發布黃燈級資安事件警訊。
- 建議行動：接收各類系統或服務的 OTP 驗證碼時請保持警覺，留意是否有異常登入行為；校內各單位若有介接外部簡訊服務，請重新檢視 API 授權與帳號安全設定。
- 參考連結： OTP簡訊平臺EVERY8D遭駭 (iThome)
4. 【AI防詐】七成民眾依賴AI處理事務，但辨識AI詐騙信心不足
- 摘要：趨勢科技調查指出，超過七成民眾會使用 AI 協助處理事務，但面對層出不窮的「AI 偽造語音」或「AI 釣魚訊息」等新型態詐騙，多數人仍缺乏足夠的辨識信心。
- 建議行動：面對未知來電、語音或視訊，若涉及金錢匯款或機敏資料索取，務必透過其他獨立管道（如掛斷後親自回撥熟知的號碼）進行二次確認。
- 參考連結： 辨識AI詐騙信心不足 (經濟日報)
5. 【校園防護】政府與學校三大資安風險：網路釣魚、社交工程、漏洞濫用
- 摘要：最新分析指出，政府機關與各級學校目前面臨的三大資安風險為：網路釣魚、社交工程攻擊以及未及時修補的系統漏洞濫用。
- 建議行動：請同仁持續培養資安意識，不隨意開啟陌生信件，並配合資訊中心政策，定期檢視公務電腦更新狀態，落實零信任防護。
- 參考連結： 政府學校資安風險 (iThome)
6. 【系統更新】TACERT發布微軟 115 年 5 月份安全性更新
- 摘要：台灣學術網路危機處理中心（TACERT）發布微軟 5 月份安全性更新通知，修補了多項可能導致遠端程式碼執行或權限提升的重大安全漏洞。
- 建議行動：請全校教職員生盡速透過 Windows Update 執行系統更新，確保個人電腦與公務設備免受已知漏洞攻擊。
- 參考連結： 微軟 5 月份安全性更新 (TACERT)
1. [Platform Security] 9,000 Schools at Risk! Canvas LMS Hacked, 275M Users i Data Exposed
- The Canvas LMS used by over 9,000 schools worldwide was hacked, potentially leaking personal data and learning records of 275 million users.
- Action: Change passwords immediately if using external Canvas services. Do not reuse school SSO passwords.
- Canvas Platform Hacked (MSN News)
2. [Anti-Fraud Alert] Tax Season Phishing! Fake Emails Claim Certificate Updates Required
- Scammers are impersonating the Ministry of Interior is Certificate Authority, claiming that users cannot file taxes without updating their Citizen Digital Certificate to steal data.
- Action: Rely only on official government websites. Never click suspicious links. Call the 165 Hotline when in doubt.
- Tax Season Phishing (Liberty Times)
3. [Enterprise Security] Top OTP SMS Platform EVERY8D Hacked, F-ISAC Issues Warning
- EVERY8D, Taiwan is leading OTP SMS provider, suffered a cyberattack. F-ISAC has issued a yellow-level security alert.
- Action: Watch for unusual login activities and OTP codes. Review departmental SMS API permissions if applicable.
- EVERY8D OTP Platform Hacked (iThome)
4. [AI Anti-Fraud] 70% Rely on AI, but Lack Confidence in Identifying AI Scams
- A survey reveals that over 70% of people use AI, but most lack the confidence to identify new scams like AI voice cloning or phishing.
- Action: Always perform secondary verification via independent channels if unknown calls or messages request sensitive data.
- Low Confidence in Spotting AI Scams (Economic Daily)
5. [Campus Protection] Top 3 Cyber Risks for Gov & Schools: Phishing, Social Engineering, and Vulnerabilities
- Recent analysis shows that government agencies and schools face three main risks: phishing, social engineering, and unpatched system vulnerabilities.
- Action: Maintain security awareness, avoid unknown senders, and regularly update work devices.
- Gov & School Cyber Risks (iThome)
6. [System Update] TACERT Releases Microsoft May Security Updates
- TACERT issued a notice for Microsoft is May security updates, patching multiple critical vulnerabilities that could lead to remote code execution.
- Action: Apply system updates via Windows Update promptly to protect personal and work devices.
- Microsoft May Security Updates (TACERT)