Chinese cyberattacks rising: NSB report

Taiwan’s National Security Bureau reports China-directed cyberattacks on the island’s critical infrastructure averaged 2.63 million intrusion attempts per day (a 6% rise versus 2024), with energy-sector attacks surging roughly 1,000% and emergency rescue/hospitals up 54%; intrusion attempts were 2.46M/day in 2024 and 1.23M/day in 2023. The NSB attributes operations to five named APT groups, identifies four main tactics (vulnerability exploitation 57%, DDoS 21%, social engineering 18%, supply-chain 4%), recorded at least 20 ransomware incidents at medical institutions, and is accelerating international cooperation—heightening operational and political risk for Taiwan-focused energy, healthcare, ICT suppliers and defense contractors (notably alongside a reported US$328.5m Lockheed FMS sensor-pod contract).

Analysis

Market structure: Taiwan’s NSB data (2.63M intrusion attempts/day, +6% y/y; energy attacks +1,000%) reallocates demand toward incident response, OT/ICS security, DDoS mitigation and cyber insurance. Winners: large managed security vendors, niche ICS/OT specialists, US defense primes supplying sensors and resilience (Lockheed Martin/LMT); losers: small Taiwanese utilities, hospital operators and local ICT suppliers facing remediation costs and reputational losses. Pricing power shifts to vendors who can offer bundled OT+IT protections and expedited patching; expect 10–25% premium for rapid-response service contracts over 12–24 months.

Risk assessment: Tail risks include a kinetic blockade or coordinated ransomware campaign that disrupts ports/energy for weeks (estimated 5–10% probability over 12 months) which would spike regional risk premia, widen Taiwan sovereign spreads by 50–150bp and knock TWD -3–8%. Near-term (days–weeks) volatility will be driven by breach disclosures and US arms sales cadence; medium-term (3–12 months) by procurement cycles and regulatory mandates. Hidden dependencies: unpatched vendor firmware and third-party maintenance channels create systemic single points of failure; class-action and insurance contagion could amplify financial losses.

Trade implications: Position into cybersecurity exposure and defense offsets: tactically prefer HACK/CIBR and select large-cap cyber names over small caps; add a modest LMT position to capture US FMS flow (contract value signaling repeat business). Hedge Taiwan country risk with short-dated puts on EWT sized to 30–50% of local equity exposure; use call spreads on LMT or long-dated cyber names to reduce premium decay. Expect elevated implied volatility for Taiwan equities and cyber stocks for 3–6 months; use calendar spreads where timing is uncertain.

Contrarian angles: Consensus focuses on pure-play cyber small caps — that may be crowded and sensitive to earnings misses; industrial control/security specialists and integrated MSSPs are underappreciated and can command durable annuity revenues. The market may underprice resilience capex: if governments mandate OT upgrades, vendors with certified OT toolchains could see 2–4x revenue re-rating over 2–3 years. Beware that rapid US/ally arms sales (e.g., LMT) could provoke reciprocal escalation, increasing short-term tail risk but raising medium-term defense spend.

Key Decisions for Investors

• Establish a 2–3% portfolio long in a cybersecurity ETF (HACK or CIBR) with a 12–24 month horizon; target +20–40% upside if regional procurement accelerates, set a 15% stop-loss.
• Add a 1–2% long position in LMT or buy a 12-month call spread (buy 1x 5% OTM, sell 1x 30% OTM) to capture US FMS tailwinds tied to Taiwan support; trim if contract awards stall.
• Hedge Taiwan equity exposure by buying 3–6 month puts on EWT sized to cover 30–50% of Taiwan exposure (suggest 10% OTM puts); increase hedge if intrusion attempts exceed 3.0M/day or publicized breaches impact major ports/utilities.
• Implement a pair trade: long HACK (1–2%) and short EWT (1–2%) to express cyber upside vs. country risk; rebalance monthly and exit on either HACK +25% or EWT -15%.
• Within 30 days, reduce direct exposure to Taiwan small-cap utilities/hospital operators by 30–50% and rotate proceeds into US-listed cyber/defense names and cash; reassess after regulatory procurement announcements or major breach disclosures.