Reports on the 4th revealed that Taiwan's National Chung-Shan Institute of Science and Technology suffered an external intrusion. United Daily News and others noted that notification did not follow promptly even after the breach was confirmed.

Two issues stand out. One is which systems were penetrated and what data was accessed. The other is the interval between detection and reporting to superior agencies, which bears directly on confidence in the response system as a whole.

Intrusions at defence research bodies often do not end as single incidents. Initial penetration commonly stops at intelligence gathering, with the access obtained used later, which widens the scope of subsequent auditing.

Taiwanese authorities are reported to be examining related systems and analysing access logs. Checking for indirect penetration through contractors is standard procedure in such cases.

The matter is not Taiwan's alone. Defence industry supply chains entangle firms across several countries, and it has been noted repeatedly that a weakness in one place can lead to data held by partners elsewhere.