Chunghwa Telecom: Delayed disclosure to Bug 2008799 GTLSCA Audit Incident Report #3 - Missing vulnerability scan
Chunghwa Telecom (GTLSCA) reported a compliance/process “Delayed Disclosure” incident related to its annual WebTrust audit. The annual audit report was obtained on 2025/12/13, and the CA became aware of an audit finding (Bug 2008799) that was not disclosed in the public incident report by 2026/1/6. The finding concerned missing vulnerability scanning, where the auditor cited inadequate validation of the scanning methodology and scope performed by a third-party cybersecurity service provider, resulting in certain website hosts being excluded from vulnerability scans. The CA stated that, under CCADB Policy 5.2, audit “findings” must be disclosed to Bugzilla within 72 hours, and that this disclosure was not completed within the required timeframe. The CA said the issue was ultimately reported after a third party notified it of the deficiency, prompting corrective disclosure. The thread includes action items such as CCADB Policy 5.2 training (including the 72-hour disclosure rule), adding a CCADB disclosure decision gate to the audit workflow, and deploying an audit-finding monitoring dashboard, and it requests closure. The bug is marked RESOLVED with resolution FIXED.
- The CA states the non-compliance period began (required 72-hour disclosure window was missed).
- The CA obtained the annual audit report containing the audit finding.
- The CA states the audit finding was identified and not disclosed in the public incident report by this date.
- The CA posted the full incident report for the delayed disclosure case.
- The incident report was scheduled to be closed (final call for comments).
- Cht representative — Posted a preliminary incident report stating the CA became aware of an audit finding not disclosed in the public incident report and that the source of disclosure was third-party reported.
- Cht representative — Posted a full incident report describing the missing vulnerability scan finding, the missed 72-hour disclosure requirement under CCADB Policy 5.2, and the timeline of non-compliance.
- Cht representative — Updated the full incident report to fix a typo.
- Cht representative — Stated Chunghwa Telecom was monitoring the bug and had no new information.
- Cht representative — Provided an action-items update including corrective disclosure completion, CCADB Policy 5.2 training, adding a disclosure decision gate, and deploying an audit-finding monitoring dashboard.
- Cht representative — Provided a follow-up action-items update with statuses for the listed remediation steps.
- Cht representative — Submitted a report closure summary describing root causes and remediation, stating action items were completed and requesting closure.
- CCADB representative — Issued a final call for comments and stated the incident report would be closed on approximately 2026-02-19.