Incident Types: The types of cybersecurity incidents that have occurred include Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with internal containment (per leaked memos), and containment measures with removal of leaked files from github, containment measures with dark web monitoring, and communication strategy with no public statement by knownsec, communication strategy with china denied breach as 'groundless', and containment measures with files removed from github, containment measures with no official confirmation of further actions, and communication strategy with chinese foreign ministry denial of breach knowledge, communication strategy with no refutation of state-associated cyber intelligence work, and enhanced monitoring with security experts recommend layered defenses beyond antivirus/firewalls..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Potential insider (2023 theft)GitHub repository misconfiguration (2025 leak).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Confidential Documents, State-Linked Hacking Operations, , Immigration Records, Malware Source Code, Reconnaissance Data (Zoomeye), Target Lists, Chat Histories, Digital Infrastructure Maps, , Government Hacking Tools (Rats, Spyware), Immigration Records (95Gb), Telecom Call Logs (3Tb), Transport Data (459Gb), Target Lists (80+ Organizations), Attack Methodologies and .

Incident Response Plan: The company's incident response plan is described as Internal containment (per leaked memos), .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by removal of leaked files from github, dark web monitoring, , files removed from github, no official confirmation of further actions and .

Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through US DoD blacklisting (January 2024), .

Key Lessons Learned: The key lessons learned from past incidents are Need for stronger cyber defenses in India,Risks of private firms in state-directed cyber operations,Vulnerability of reconnaissance tools (e.g., ZoomEye) to exposure,Importance of insider threat mitigationPrivate cybersecurity firms can be deeply entangled in state-sponsored operations, creating significant risks if breached.,GitHub and public repositories require stricter monitoring for sensitive data leaks.,Advanced hacking tools (e.g., RATs, spyware, malicious hardware) pose evolving threats beyond traditional malware.,Critical infrastructure in multiple countries is actively targeted by state-associated actors.,Basic antivirus/firewalls are insufficient; layered defenses (e.g., network segmentation, behavioral analysis) are essential.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: WION (World Is One News)Url: https://www.wionews.comDate Accessed: 2024-05-01, and Source: Mrxn (Chinese News Outlet), and Source: International Cyber Digest (X/Twitter), and Source: Chinese Foreign Ministry StatementDate Accessed: 2025-11-02 (estimated).

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through No Public Statement By Knownsec, China Denied Breach As 'Groundless', Chinese Foreign Ministry Denial Of Breach Knowledge and No Refutation Of State-Associated Cyber Intelligence Work.

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Security Experts Recommend Layered Defenses Beyond Antivirus/Firewalls, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Unknown (No Official Response From Knownsec Or Chinese Government), Experts Recommend Overhauling Access Controls And Third-Party Risk Management, .

Last Attacking Group: The attacking group in the last incident was an Unknown (Suspected Insider or Ideological Actor)Potential State-Sponsored Affiliation.

Most Recent Incident Detected: The most recent incident detected was on 2024-05-01T00:00:00Z.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-11-02.

Most Significant Data Compromised: The most significant data compromised in an incident were 12,000+ confidential documents, , 12,000+ internal documents, 95 GB of Indian immigration data (allegedly stolen in 2024), Blueprints/source code for advanced malware, Remote access tools, Hardware implants (e.g., malicious USB chargers/power banks), Digital infrastructure maps of India, Target lists spanning Asia, Europe, and Africa, Chat histories from WeChat, QQ, and Telegram, ZoomEye reconnaissance data, , 95GB of Indian immigration records, 3TB of South Korean call logs (LG U Plus), 459GB of Taiwanese transport data, Hacking tools (RATs, Android spyware, malicious power bank), List of 80 foreign organizations targeted (critical infrastructure), Details of attacks on 20+ countries/regions and .

Most Significant System Affected: The most significant system affected in an incident was KnownSec’s secure serversGitHub (briefly hosted leaked files).

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Removal of leaked files from GitHubDark web monitoring and Files removed from GitHubNo official confirmation of further actions.

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were 12,000+ internal documents, 95GB of Indian immigration records, 95 GB of Indian immigration data (allegedly stolen in 2024), Blueprints/source code for advanced malware, 3TB of South Korean call logs (LG U Plus), Chat histories from WeChat, QQ, and Telegram, 459GB of Taiwanese transport data, Hacking tools (RATs, Android spyware, malicious power bank), List of 80 foreign organizations targeted (critical infrastructure), Details of attacks on 20+ countries/regions, Remote access tools, Hardware implants (e.g., malicious USB chargers/power banks), ZoomEye reconnaissance data, Target lists spanning Asia, Europe, and Africa, Digital infrastructure maps of India, 12 and000+ confidential documents.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 36.1K.

Most Significant Legal Action: The most significant legal action taken for a regulatory violation was US DoD blacklisting (January 2024), .

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Basic antivirus/firewalls are insufficient; layered defenses (e.g., network segmentation, behavioral analysis) are essential.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Strengthen India’s immigration data protection, Invest in threat intelligence sharing to counter cross-border cyber espionage., Conduct regular audits of third-party code repositories for exposed secrets., Implement zero-trust architectures and continuous network monitoring., Improve international collaboration on cyber espionage threats, Conduct forensic analysis of leaked tools for indicators of compromise (IoCs), Enhance monitoring of Chinese cybersecurity firms, Develop international norms for cybersecurity firms’ involvement in state operations. and Enhance insider threat detection and access controls for sensitive projects..

Most Recent Source: The most recent source of information about an incident are International Cyber Digest (X/Twitter), WION (World Is One News), Chinese Foreign Ministry Statement and Mrxn (Chinese News Outlet).

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.wionews.com .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (unofficial; no public updates from KnownSec or Chinese government).

Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was Possibly years (since 2023).

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Potential insider threatInadequate access controlsLack of transparency in state-private cyber collaborations, Likely insider threat or compromised credentials (2023 theft)Inadequate protection of sensitive files (GitHub exposure)Blurred lines between private cybersecurity work and state operations.

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Unknown (no official response from Knownsec or Chinese government)Experts recommend overhauling access controls and third-party risk management.