BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 022
Taiwan

CPC Corporation Taiwan Ransomware Attack (2020)

Volume 2Oil and Gas edition2020Last verified 16 sources, 15 primaryAttributed by Taiwan's Investigation Bureau

In May 2020 ransomware reached thousands of office computers at Taiwan's state oil company, and card and app payments at its stations faltered. By the company's account, production was never damaged and fuel supply never stopped.

CPC belongs here for what did not happen. Ransomware reached more than 7,500 office computers, by a spokesman's count as reported, and the company's own card and app payments at its stations stopped. By CPC's account, production was never damaged, cash and credit cards kept the queues moving, and the only pump pauses came from its own reset. The operator did well: it found the attack fast, reported within about an hour, and kept a second way to get paid.

The harder reading is in the investigators' account. By the bureau's telling, an intruder whose code first ran on a CPC computer in 2016 ended in control of the directory that tells office machines what to run. That directory evidently reached payment. Nothing published says where its reach stopped. CPC says production was untouched, and we take that at its word; whether separation or good fortune kept it so is BlastWave's question, not a disclosed fact.

What is not known: CPC has never published a cost, a date its office systems were fully restored, or how its production network is separated from the directory the attacker controlled. The Investigation Bureau's own May 2020 text could not be retrieved; its attribution is quoted from an August 2020 presentation as reported, and no indictment or sanction names CPC. Whether the ColdLock sample a vendor analysed is the program found at CPC is undisclosed. How many stations paused dispensing, and for how long, is not on the record.

Recommendation

  1. Take the path away A group policy written on an office domain controller should have nowhere to land on refinery, terminal or pump island systems.
  2. Remove standing admin credentials The attacker stole privileges and rewrote group policy overnight. Grant policy rights for a window, bound to a verified identity, and alarm on every change.
  3. Read one way, keep a second way to pay Loyalty, fleet and app systems take station data one way, and cash and card acceptance stays independent. CPC's did, and that part worked.
The Coin Changer
Podcast · Joe and Cam · 8:58
CPC Corporation Taiwan Short
Video · 60 to 90 seconds

Sources: CPC releases, 4 and 23 May 2020 (cpc.com.tw); CPC via MOEA, 7 May 2020, as reported by iThome; MJIB, CYBERSEC 2020 talk, Aug 2020, as reported by iThome; Trend Micro, ColdLock, 6 May 2020. Full list with links.

Soft Spots: Production untouched is CPC's account, not audited. The bureau's grain is reported from its 2020 talk; its later tie to US charges on suspected APT41 members, as reported, does not name CPC. The closing question is BlastWave's analysis.

The full record

Every claim numbered to its source. Last updated .

Ransomware reached the office computers and the station payment systems of Taiwan's state oil company; by the company's account, production was never damaged. What is verified, what is only reported, and what is still unknown.

Summary

In May 2020, ransomware spread through CPC Corporation, Taiwan's state oil company, reaching more than 7,500 office computers by a reported official count and making its own payment card and app unusable at stations. By CPC's account, production was not damaged and fuel supply never stopped. Taiwan's Investigation Bureau attributed it to Winnti Group or a closely associated group.1,2,4,5,11

Timeline of the CPC Corporation ransomware attack

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. By the Investigation Bureau's account, a malicious program first runs on a CPC computer.4
  2. By the same account, Formosa Plastics group systems are first intruded upon.4
  3. The earliest attacker activity found by CyCraft, according to its co-founder's later presentation. A researcher finding.9
  4. CPC notices that part of its payment systems is behaving abnormally. Its payment card and CPC Pay app cannot be used; it asks customers to pay cash or credit card.1,2
  5. CPC reports to the Ministry of Economic Affairs, disconnects its internal network, brings in responders and files a level three cyber security incident. It says production and manufacturing systems were not damaged.2
  6. By CPC's later account, card systems, which kept serving customers by offline authorization, are repaired that evening; CPC Pay the next day.6
  7. By CPC's 7 May account, fleet, member and payment card systems are restored from this date.11
  8. Trend Micro publishes an analysis of ColdLock ransomware in attacks on unnamed Taiwanese organizations; it names no victim and no attacker. Powertech Technology files a disclosure that its Hukou site was attacked on 4 May.10,12
  9. Some CPC stations are found not dispensing and a second attack is rumored. CPC's third statement says pumps paused while pump island computers were reset, station by station, and that fuel supply to stations was not interrupted.11
  10. The Investigation Bureau announces that the attacks were the work of one group, Winnti Group or an associated group, as reported. CPC denies reports of continuing attacks: a single employee computer fault on 14 May had been mistaken for infection.13,14
  11. Business Weekly reports, and iThome repeats, the state enterprise commission spokesman's figure of more than 7,500 infected CPC computers, and that the first infected machines were in administrative buildings at the naphtha cracker sites.5
  12. CPC's release rejects a press rumor that an infected USB stick started the attack, quoting the bureau's 15 May statement that entry came months earlier through employee computers, web and database servers.6
  13. At CYBERSEC 2020 in Taipei, the head of the bureau's Cyber Security Division presents its findings, including the attribution grain and the April 2016 first execution. A CyCraft co-founder presents a different view.4,9
  14. The US Justice Department announces charges against suspected APT41 members. Taiwan is among the victim countries; no Taiwanese victim is named.8
  15. At a press conference with the FBI, a bureau official says evidence from the May cases went to US prosecutors, as reported. The statement does not name CPC.7

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
When was it found?Shortly after noon on 4 May 2020, in part of the payment systems1,2Verified
Which payments were affected?CPC's own payment card and the CPC Pay app; cash and credit cards worked1Verified
Was production affected?Not by CPC's account: production and manufacturing systems "not damaged"; not independently audited2,6Verified (company's account)
Was fuel supply interrupted?Not by CPC's account, though some pumps paused on 6 and 7 May during resets11Verified (company's account)
How many computers were hit?More than 7,500 of 10,000 or more Windows administrative computers, a spokesman's figure as reported5Reported only
Who was the attacker?"Winnti Group, or hackers closely associated with that group," per Taiwan's Investigation Bureau, as reported4Government assessment, reported
Did APT41 attack CPC?No indictment or sanction names CPC; the bureau later tied its evidence to US charges that name no Taiwanese victim7,8Reported only
How did the intruders get in?Web servers and employee computers; first execution April 2016, per the bureau4,6Government account, reported
Was an infected USB stick to blame?Not by CPC's account: it rejected that rumor in writing on 23 May 2020, citing the bureau6Verified
Was the ransomware ColdLock?Not shown. Trend Micro named ColdLock for unnamed Taiwanese victims10Undisclosed
What did it cost?No figure publishedUndisclosed
How many stations paused, and for how long?Not on the recordUndisclosed

Was CPC's refinery or fuel production hacked?

Not by CPC's account: the company said its production and manufacturing systems were not damaged, and no record read for this entry shows otherwise. On 4 May 2020 CPC's own release said "無法使用捷利卡、中油PAY等相關作業，請消費者加油先使用現金及信用卡，其餘生產和供應並未受到影響" (the payment card and CPC Pay cannot be used; customers should pay cash or credit card; the rest of production and supply is not affected).1 The same day's statement, as reported, said the internal systems for producing and manufacturing oil products "並沒有受到勒索軟體的損害" (not damaged).2 On 23 May CPC added that "煉製、供油、送油均維持正常運作" (refining, supply and delivery all kept operating normally).6

Business Weekly reported that the first infected machines at CPC were in administrative buildings at the naphtha cracker sites, that production industrial computers were not affected, and quoted a refinery employee saying the plant computers were fine.5 That is supporting reporting, not an audit. Production untouched is CPC's account, and it is carried here as the company's statement.

CPC never described how its production systems are separated from its office network. Its only published statement about architecture concerns franchise stations:

"各加盟站營運電腦系統均係獨立設置運作並未受駭" (franchise stations' operating computers are set up independently and were not hacked)
CPC Corporation, Taiwan, news release, 23 May 20206

Did CPC's gas stations stop selling fuel?

Station sales kept running on 4 May with cash and credit cards; the only physical stops on the record are pauses at some pumps on 6 and 7 May, during CPC's own recovery. CPC's payment card and CPC Pay app could not be used on 4 May.1 CPC gave two accounts of the repair. On 7 May it said the fleet, member and payment card systems were restored from 5 May.11 On 23 May it said the card systems "採離線授權方式繼續提供消費者加油，且於當日晚上即修復正常" (kept serving customers by offline authorisation and were repaired that evening), with CPC Pay repaired the next day; online and voice ordering were briefly affected, and phone and fax ordering were used.6

On 6 and 7 May some customers found CPC stations not dispensing, and the rumor was a second attack. CPC's third statement, issued at 14:30 on 7 May and reported the same day, said no: stations were re-checking computers one by one, and supply paused at a pump during "泵島電腦的重整作業，而暫停供應" (pump island computer reset). It added that "加油站的油品供應沒有中斷" (fuel supply to stations not interrupted).11 How many stations paused, and for how long, is not on the record.

On 15 May CPC also denied reports of continuing attacks: a single employee computer fault on 14 May had been mistaken for infection.14 A CyCraft co-founder later said that on 4 May customers could use only self-service pumps; CPC said station sales ran normally with cash and credit card. These are two accounts, and this page uses neither as fact.1,9

Who attacked CPC? Was it Winnti, China or APT41?

Taiwan's Investigation Bureau attributed the intrusion to Winnti Group or a closely associated group; that is one government's investigative assessment, and no indictment or sanction names CPC. The bureau's fullest account was a presentation in August 2020, reported in Chinese by iThome:

"該駭客組織為Winnti Group，或與該組織具密切關聯的駭客" (Winnti Group, or hackers closely associated with that group)
Wu Fu-mei (吳富梅), Director of the Cyber Security Division, Ministry of Justice Investigation Bureau, CYBERSEC 2020, Taipei, as reported by iThome, 12 August 20204

The bureau based the judgment on backdoors, relay server IP addresses and domain names.4 Its own 15 May 2020 statement could not be retrieved for this entry. Reports of it agree on Winnti Group or an associated group and differ on nationality: some say the attack came from overseas or from outside the territory (海外, 境外), iThome's says Chinese (中國).13 This page adds no nationality to the bureau's grain, because the bureau's own text has not been read.

APT41 enters the record only in September 2020. At a press conference with the FBI on 18 September, a bureau official, 劉家榮, said, as reported by iThome, that the bureau gave relay server (VPS) information from the May cases to US prosecutors, who charged "五名疑似APT41的中國籍駭客" (five Chinese hackers suspected of being APT41), and that APT41 in May "鎖定臺灣關鍵基礎設施業者以及高科技業者發動攻擊" (targeted Taiwan's critical infrastructure and high tech firms). That sentence does not name CPC.7 The US Justice Department's release of 16 September 2020 lists Taiwan among the victim countries, names no Taiwanese victim and no oil or energy victim, and says the five Chinese nationals were charged in two indictments, of August 2019 and August 2020.8 The accurate statement is that the bureau later linked its evidence to US charges against suspected APT41 members, as reported. It is not an attribution of this incident.

At the same August 2020 conference, CyCraft co-founder Jeremy Chiu (邱銘彰) suggested APT10 instead, said the two groups share tools, and said ransom was probably not the real motive.9 That is a vendor analyst's view, not a finding.

How did the attackers get into CPC's network?

Through web servers and employee computers, by the Investigation Bureau's account, with the first malicious program running on a CPC computer in April 2016. CPC's 23 May release quoted the bureau's 15 May statement verbatim: "查係在數月前透過員工個人電腦、網頁及DB伺服器，入侵公司內部網路並開始刺探與潛伏" (entry months earlier through employee computers, web and database servers).6 In August 2020 the bureau put the earliest malicious execution at a CPC computer in April 2016, and said Formosa was first intruded upon in September 2019.4 That is the earliest execution the bureau found, not a claim of continuous presence.

The bureau described the end game as the directory. As reported, the attacker:

  • entered through web servers and employee computers;4
  • stole account privileges and reached the Active Directory servers;4
  • tampered with group policy in the early hours and pre-staged a file called lc.tmp on internal servers;4
  • had the ransomware loaded into memory on each computer as users logged in, which then showed a ransom message with a contact email address.4

CyCraft's co-founder said the earliest activity his team found began on 26 April 2020, and that ransomware was deployed across several victims on 4 and 5 May.9 Trend Micro published an analysis of a ransomware family it named ColdLock on 6 May 2020, in attacks on unnamed Taiwanese organizations; it named no victim and attributed it to no one, and described distribution through Active Directory group policy against database and email services.10 Same week, same country and same delivery method is adjacency, not identification. No source read for this entry says the program found at CPC is the sample Trend analyzed.

Which other Taiwanese companies were hit the same week?

Formosa Plastics group computers and Powertech Technology's Hukou site were also hit in early May 2020. Business Weekly, as reported by iThome, said the first infected Formosa machines were at the Mailiao complex, in administrative buildings, and that production industrial computers were not affected.5 Formosa Petrochemical's own statement was not retrieved, so this page states nothing about its production as a company statement, and the Mailiao detail stays attributed to reporting. The Investigation Bureau said in August 2020 that Formosa was first intruded upon in September 2019.4

Powertech Technology, a chip packaging firm, filed a material information disclosure on 6 May 2020 saying its Hukou site was attacked on 4 May; reporting of the filing describes a brief stoppage.12 The Investigation Bureau announced on 15 May that the attacks were the work of one group, as reported.13

What is still not known about CPC Corporation Taiwan

  • What the incident cost. CPC has never published a figure.1,6
  • When CPC's office systems were fully restored.
  • How CPC's production network is separated from the directory the attacker controlled. CPC has described only the independence of franchise stations' operating computers.6
  • The Investigation Bureau's own 15 May 2020 text, which could not be retrieved; reports of it differ on nationality.13
  • How the attacker first obtained privileged access, and why the directory could reach payment systems.4
  • Whether the ColdLock sample Trend Micro analyzed is the program found at CPC.10
  • How many stations paused dispensing on 6 and 7 May, and for how long.11
  • Formosa Petrochemical's own statement on its production, which was not retrieved.

Claims about CPC Corporation Taiwan the record does not support

Widely repeated claimWhat the record says
"Winnti Group's ColdLock ransomware hit CPC."Two sources welded into one noun. The Investigation Bureau named an actor; Trend Micro named a ransomware family for unnamed victims and attributed it to no one. No source we could find joins the two.4,10,15
"APT41 attacked CPC."No indictment or sanction names CPC. The bureau later linked its May evidence to US charges against suspected APT41 members, as reported; the US release names no Taiwanese victim.7,8
"An infected USB stick was suspected."A press rumor. CPC rejected it in writing on 23 May 2020, quoting the bureau: entry months earlier through employee computers, web and database servers.6
"The attackers spent weeks probing."The bureau put the first malicious execution on a CPC computer in April 2016. That is years, not weeks.4
"CPC initially called it a system crash."CPC's first release on 4 May 2020 already said malware and ransomware.1
"CPC's OT was isolated."CPC said production systems were not damaged. It never described how they are separated; its only architectural statement is about franchise stations.6
"Recovery cost $3 million to $6 million, and more than 1,000 gas stations were affected."No source found for either figure. CPC has published no cost and no station count.1,6

Including our own. Our Volume 1 Hackopedia entry printed "Winnti Group's ColdLock Ransomware" as one noun, joining an actor named by one source to a malware name published by another. It also printed about $3 million to $6 million in recovery and downtime, more than 1,000 gas stations, the website offline about a day, a suspected infected USB, attackers spending weeks probing, CPC initially calling it a system crash, and OT isolated. None traces to a source we could find, except that the USB story was a press rumor; it and the system crash are contradicted by CPC's own releases.1,6,15 Each is corrected here. We correct our own record first; it is what earns the right to correct anyone else's.

Did any regulator or oversight body make findings about CPC?

None that makes a finding about CPC, in any record read for this entry as of late September 2026. CPC reported the incident to the Ministry of Economic Affairs and the Executive Yuan as a level three cyber security incident.2 No government advisory names CPC. A Control Yuan study of the National Security Bureau's response to PRC cyber warfare, covering the first half of 2020, lists CPC with two other companies among ransomware cases on critical infrastructure; it attributes nothing and makes no finding about CPC.16 No Legislative Yuan record of the incident was found.

BlastWave analysis: the office reached the till

Analysis, not a disclosed fact

CPC belongs in this record as much for what did not happen as for what did. Ransomware spread across its administrative computers and its own card and app payments faltered at the stations, but by CPC's account production was never damaged, and cash and credit cards kept the queues moving. That places it as an IT compromise that reached the point of sale, with no halt to production on the record and brief, partial dispensing pauses at some pumps during recovery. The operator comes out of this well: it disconnected its network, reported within about an hour, and kept a way to take money that did not depend on the system under attack.1,2,11

The open question is the one the investigators' account raises. By the bureau's account, an attacker whose code first ran on a CPC computer in 2016 ended in control of the directory that tells office machines what to run.4 That directory evidently reached payment, as shown by what failed. Nothing published says where its reach stopped. CPC says production was untouched, and this entry takes that at its word. Whether separation or good fortune kept it untouched is BlastWave's question, not a disclosed fact.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Coin Changer” (8:58). Joe Baxter and Cam Cullen on why ransomware that reached the till, and by CPC's account never the tank, still raises an architecture question, and what our first account got wrong.

Video: CPC Corporation Taiwan Short (60 to 90 seconds).

Frequently asked questions

What happened in the CPC Corporation Taiwan ransomware attack?

Shortly after noon on 4 May 2020, CPC Corporation, Taiwan's state oil company, found part of its payment systems behaving abnormally. Ransomware had reached its office computers, and its own payment card and CPC Pay app could not be used at stations. CPC disconnected its internal network and reported a level three incident. It said production systems were not damaged and that cash and credit card payments worked.

Was CPC's oil production or refining affected by the ransomware?

Not by CPC's account. In its 4 May 2020 statement CPC said its systems for producing and manufacturing oil products were not damaged, and on 23 May it said refining, supply and delivery all kept operating normally. That is the company's statement, supported by Business Weekly reporting, and has not been independently audited. CPC has never described how its production network is separated from its office systems.

Did CPC gas stations run out of fuel or stop pumping?

CPC said fuel supply to its stations was never interrupted, and that station sales continued on 4 May 2020 with cash and credit cards. On 6 and 7 May some pumps paused while CPC reset pump island computers one by one, which CPC said on 7 May was its own recovery work, not a second attack. How many stations paused, and for how long, is not on the record.

Who was behind the CPC ransomware attack?

Taiwan's Ministry of Justice Investigation Bureau attributed it to "Winnti Group, or hackers closely associated with that group," according to iThome's report of the bureau's August 2020 conference presentation. That is a single government assessment. No indictment or sanction names CPC. A CyCraft co-founder suggested APT10 instead, and said the two groups share tools.

Was APT41 responsible for the CPC attack?

No indictment or sanction names CPC. In September 2020 a bureau official said, as reported by iThome, that evidence from the May cases helped US prosecutors charge suspected APT41 members. The US Justice Department's release of 16 September 2020 lists Taiwan among victim countries but names no Taiwanese victim.

How did the hackers get into CPC's network?

Taiwan's Investigation Bureau said the intruders entered through web servers and employee computers, and that a malicious program first ran on a CPC computer in April 2016. As reported from its August 2020 presentation, they stole account privileges, reached the Active Directory servers and tampered with group policy in the early hours, so computers loaded the ransomware as users logged in. CPC has published no vector of its own.

Was the CPC attack caused by ColdLock ransomware?

That is not shown. Trend Micro named a ransomware family ColdLock in an analysis dated 6 May 2020 of attacks on unnamed Taiwanese organizations, and attributed it to no one. No source read for this entry says the program found at CPC is the sample Trend analyzed. The Investigation Bureau's own account names the payload only as a file called lc.tmp pushed by group policy.

How much did the CPC ransomware attack cost?

The cost is undisclosed. CPC has never published a figure, and none appears in its May 2020 statements. Figures of $3 million to $6 million in recovery, and of more than 1,000 affected stations, appeared in our own Volume 1 entry, but no source this entry could find supports either one.

Colonial PipelineA business-network compromise led the operator to stop product moving; at CPC, product moved and the business side limped.HalliburtonAn energy company whose documented disruption was delayed invoicing and collection: the same shape seen from the billing end.ShamoonA state energy company's office was wiped while production, by the company's account, ran on; CPC is that shape one step closer to the customer.

Sources

Primary sources are CPC's own dated statements, the Investigation Bureau's findings, the US Justice Department's release, a Control Yuan study and named researchers' published work. Several CPC and bureau statements are no longer online at their original addresses and are cited as reported, in Chinese, by iThome; translations are ours. Press is cited only as evidence of what was said.

  1. CompanyCPC Corporation, Taiwan, news release, 4 May 2020 (cpc.com.tw): payment card and CPC Pay unavailable; customers to pay cash or credit card; "其餘生產和供應並未受到影響"; malware and ransomware.
  2. CompanyCPC Corporation, Taiwan, statement issued through the Ministry of Economic Affairs, 4 May 2020, as reported by iThome (黃彥棻), "中油資料庫和部分電腦主機遭勒索軟體感染，斷網防受駭範圍擴大，暫通報為三級資安事件" (CPC databases and some host computers infected with ransomware; network disconnected; reported as a level three incident), 4 May 2020. ithome.com.tw
  3. CompanyCPC Corporation, Taiwan, "CPC at a Glance" (cpc.com.tw, English site).
  4. GovernmentMinistry of Justice Investigation Bureau, presentation by Wu Fu-mei (吳富梅), Director of the Cyber Security Division, CYBERSEC 2020, Taipei, as reported by iThome (翁芊儒), "調查局完整揭露中油、台塑遭勒索軟體攻擊事件調查結果" (Investigation Bureau fully discloses its findings on the ransomware attacks on CPC and Formosa Plastics), 12 August 2020. ithome.com.tw
  5. PressBusiness Weekly (商業周刊) issue 1696, as reported by iThome (周峻佑), "中油與台塑遭攻擊事件的受害規模，首度被媒體揭露" (scale of the attacks on CPC and Formosa Plastics revealed by the media for the first time), 18 May 2020. Cited for the state enterprise commission spokesman's figure as reported and as evidence of what was said. ithome.com.tw
  6. CompanyCPC Corporation, Taiwan, news release, 23 May 2020 (cpc.com.tw): refining, supply and delivery operating normally; card systems served by offline authorization and repaired that evening; franchise stations' computers independent; USB rumor rejected; quotes the Investigation Bureau's 15 May 2020 statement.
  7. GovernmentMinistry of Justice Investigation Bureau and FBI press conference, 18 September 2020, as reported by iThome, 18 September 2020. ithome.com.tw
  8. FederalUS Department of Justice, release on charges against seven international cyber defendants, including APT41 actors, 16 September 2020. justice.gov
  9. ResearcherJeremy Chiu (邱銘彰), co-founder of CyCraft (奧義智慧), CYBERSEC 2020, Taipei, as reported by iThome, 12 August 2020. A vendor analyst's view. ithome.com.tw
  10. ResearcherTrend Micro, "Targeted Ransomware Attack Hits Taiwan Organizations" (ColdLock), 6 May 2020. Names no victim and no attacker. trendmicro.com
  11. CompanyCPC Corporation, Taiwan, third statement, 7 May 2020, 14:30, issued on the Ministry of Economic Affairs website, as reported by iThome (周峻佑), 7 May 2020. ithome.com.tw
  12. Company filingPowertech Technology, material information filing on the Market Observation Post System, 6 May 2020, as reported by iThome (羅正漢), 6 May 2020. ithome.com.tw
  13. GovernmentMinistry of Justice Investigation Bureau, release and press conference of 15 May 2020, as reported by iThome, 15 May 2020; also as reported by PTS and the Central News Agency (CNA 202005155006). The bureau's own text was not retrieved. ithome.com.tw
  14. CompanyCPC Corporation, Taiwan, statement of 15 May 2020, as reported by iThome (周峻佑), 15 May 2020. ithome.com.tw
  15. CompanyBlastWave, Hackopedia Volume 1, "CPC Corp. Taiwan (2020) Ransomware," ebook entry and live page at hackopedia.blastwave.com. Cited as evidence of what we published; corrected by this entry.
  16. GovernmentControl Yuan (監察院), general study of the National Security Bureau's response to PRC cyber warfare, first half of 2020.

Cite this page

BlastWave. “CPC Corporation Taiwan Ransomware Attack (2020): What Is Verified.” Hackopedia, Volume 2, FILE 022. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/cpc-corporation-taiwan-2020/

Revision history

DateChange
6 Oct 2026Numbered FILE 022 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026Final consistency check against related entries. Restored "suspected" and "as reported" to the sentence on the bureau's later tie to US charges. Searched again for Formosa's own filing on where its first infections were found; none was found, so that detail stays attributed to reporting.
26 Sep 2026Full validation. Confirmed the US Justice Department release names no Taiwanese victim and that the five Chinese nationals were charged in two indictments, August 2019 and August 2020. Corrected the reasoning for how this incident ranks against incidents that halted physical operations.
25 Sep 2026Primary-source pass using CPC's own releases of 4 and 23 May 2020. Corrected three points: the APT41 link (no indictment or sanction names CPC, and the US charges name no Taiwanese victim), the USB story (rejected by CPC in writing), and CPC's only statement about architecture (franchise stations, not production). Card and app payments now read "faltered" rather than "failed," after CPC's account of offline authorization. Confirmed Trend Micro's ColdLock analysis is dated 6 May 2020 and names no victim.
24 Sep 2026Volume 2 entry built from primary sources. Corrected Volume 1 errors: an actor and a malware name joined into one, cost and station figures with no source, "weeks" of probing, and OT isolation CPC never claimed.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry