AI & Data Attacks: A Dangerous Leap in Cyberspace

In recent years, AI has not only been a powerful support tool but is also becoming a sophisticated weapon in the hands of hackers. At many domestic professional events, cybersecurity experts warn that AI-powered attacks are accelerating and becoming more diverse in both scale and method.

The Latest “Hot” Numbers in Vietnam

• A Fortinet/IDC survey shows that 52% of businesses in Vietnam have faced AI-powered cyber threats within the last year.
• According to a report from the National Cybersecurity Association (NCA), 2024 saw approximately 659,000 cyberattacks targeting organizations and businesses, and 46.15% of surveyed entities reported being attacked at least once.
• Data from Viettel reveals that more than 14.5 million user accounts in Vietnam have been leaked, accounting for up to 12% of the total global data leak victims.
• The financial impact is also severe: many businesses have suffered significant losses, with some incidents exceeding half a million USD due to data breaches or the loss of sensitive information.

New Threats

Experts are currently observing the following AI-powered attack trends:

• Phishing/Scams using deepfakes, fake voices, facial impersonation, or fake emails/businesses to deceive customers or internal employees. AI helps automate this process, making the schemes more flexible and sophisticated.
• Account Takeover Attacks, exploiting weak passwords and automated attacks (botnets). AI assists in faster reconnaissance and brute-force password attempts.
• Zero-day vulnerabilities, malware capable of evading detection systems, encryption, obfuscation, and “prompt injection” attack techniques in AI systems.
• Attacks on critical digital infrastructure and systems such as finance, telecommunications, and logistics, where sensitive data or control systems are crucial.

Relevance and Impact in Vietnam

Vietnam is in a rapid digital transformation phase, with AI being applied in many sectors: public services, healthcare, banking, education, and smart cities. This creates both great opportunities and increased risks:

• The data leak at the Credit Information Center (CIC), managed by the State Bank of Vietnam, has raised concerns about unauthorized access to citizens’ financial data, including credit information and risk analysis. The hacking group ShinyHunters is suspected of being involved.
• Small and Medium-sized Enterprises (SMEs) face barriers such as high costs, limited human resources, and a lack of sophisticated defense models. Many do not have the capability to detect AI-powered attacks early.
• The shortage of cybersecurity personnel, a lack of expertise in AI, and the absence of a clear data management strategy are key weaknesses.

Laws, Policies & Current Steps

• The Digital Technology Industry Law, passed by the Vietnamese National Assembly on June 14, 2025, will take effect on January 1, 2026, establishing the first legal framework for managing digital technology, digital assets, and AI.
• Vietnam plans to enact a separate AI Law and update the National AI Strategy in late 2025.
• Decree 13 on personal data protection, which took effect in 2023, has laid a foundation for personal data protection. However, there are still many inadequacies regarding implementation, authority, and coordination between agencies.

Expert Commentary

Domestic and international experts have made the following assessments:

• AI-powered cyberattacks have a higher success rate due to automation and the ability to analyze and exploit vulnerabilities quickly, especially if defense systems are weak, lack monitoring, and are not updated.
• At the same time, AI is also an effective defensive tool: it powers automated monitoring systems, anomaly detection, behavioral analysis, and machine learning to predict and prevent attacks early.
• However, to fully leverage this defensive role, businesses and government agencies must invest comprehensively in technology, people, processes (governance), and legal capabilities.
• Some experts note that without a clear AI Law and ethical standards—including transparency, verification, and certification—AI systems could also be exploited, potentially causing greater harm than conventional data leaks, such as fake news, reputational damage, social impact, and loss of trust.

Conclusion & Recommendations

Based on the available information, a few conclusions and recommendations can be drawn:

• AI is a double-edged sword: it creates breakthroughs for the economy and society while also serving as a new means for high-tech crime.
• In the context of Vietnam’s rapid digital transformation, without proper management, the consequences of data leaks, privacy loss, financial damage, and even national digital security risks will be significant.
• It is crucial to expedite the completion of the legal framework: the AI Law, Personal Data Protection Law, and Digital Technology Law need to be clear, verifiable, transparent, and have extraterritorial effect if necessary.
• Strengthen human and technological defense capabilities: train experts, build SOC (Security Operations Center) and AI teams, apply early detection tools, implement secure by design principles, and conduct regular testing.
• Promote international cooperation: share threat intelligence, adhere to international standards, and collaborate to combat cross-border hackers and international cybercrime groups like ShinyHunters.