Mega Securities places great importance on information security and personal data protection, viewing them as essential to safeguarding customer rights and interests, strengthening corporate resilience, and advancing sustainable business operations. Through a comprehensive information security governance framework, management systems, and risk control mechanisms, the Company continuously enhances its cybersecurity capabilities. Information security management, personal data protection, and business continuity management are integrated into daily operations and corporate governance practices to foster a secure and trustworthy financial services environment.
In terms of information security management, Mega Securities has established a comprehensive cybersecurity governance framework and continues to maintain international certifications for the ISO 27001 Information Security Management System (ISMS) and ISO 22301 Business Continuity Management System (BCMS). In 2025, the Company invested NT$43.65 million in information security, representing 11.85% of total information technology expenditure. Through measures including a Security Operations Center (SOC), vulnerability scanning, penetration testing, social engineering drills, DDoS protection mechanisms, and phishing website detection, the Company strengthened the security of its information systems. Mega Securities was also recognized as an Outstanding Performer in the Threat Intelligence Sharing Evaluation conducted by the Financial Information Sharing and Analysis Center (F-ISAC) for the second consecutive year. No material cybersecurity incidents or regulatory penalties related to information security occurred during the year.
With respect to customer privacy and personal data protection, Mega Securities has established personal data protection policies and internal control mechanisms in accordance with the Personal Data Protection Act and other applicable regulations. The Company regularly conducts personal data inventories, risk assessments, and employee training programs and continues to maintain certification under the BS 10012 Personal Information Management System. In 2025, the headquarters and Zhongxiao Branch further obtained BS 10012 certification, demonstrating that the Company's personal data management practices meet internationally recognized standards.
Throughout 2025, there were no incidents of personal data breaches, customer privacy violations, or information security events resulting in harm to the rights and interests of customers or employees. Mega Securities remains firmly committed to upholding the highest standards of information security and personal data protection.
