Additional Information Disclosure

Cyber Security Management

To control or maintain important corporate operating functions, including operation and accounting, etc. functions, of the Company, the Company relies on a network system. However, the network system may be subject to network attack such that confidential information of the Company may be stolen, such as exclusive information of customers or other stakeholders, as well as personal information of employees. Malicious hackers may also try to introduce computer viruses, destructive software, or ransomware into the Company’s network system, interfering with the operation of the Company in order to regain control rights of the computer system such that it may perform ransom or steal confidential information from the Company.

Countermeasures:

1. The Company’s IT department, under the Administration and Management Division, and appointed the Cyber security manager, the IT department periodically checks the information security of the Company, which is led by the IT department head. The IA department audits the computer cycle-information security annually and reports the audit results to the Audit Committee and Board of Directors.
2. The company has established the Information Security Policy. It established by the Company’s IT department which includes (a) Data redundancy, (b) Data storage, (c) System security, (d) level of risk, e. authorization and f. regulations of the system and email usage. The Company announces the policy on the intranet in order to allow all employees to access and to comply. The IT department periodically evaluate the information security in compliance with the policy and reports information security in compliance with the policy and reports to the Board of Directors.
3. Perform major updates of systems irregularly. In the case of major information security risks, the announcement is made, and corresponding measures are adopted. Arrange information security courses every year for training an employee to identify fishing emails. The system is protected by password, and the authentication scheme is Single sign-on which is easy to maintain and manage.
4. To strengthen network security, cope with the popularity of the Internet of Things and the information security issues associated. Reduce hazards caused by viruses, worms, and other network attacks, adopt various security preventive measures and update periodically, including the technologies of firewalls, intrusion detection systems, anti-virus software, etc., in order to respond to and reduce harm caused by various network attacks in a timely manner.
5. The information system infrastructure has been established with host machine redundancy and remote data backup mechanisms of high availability in order to ensure uninterrupted service. Daily perform network operating environment detection and regular data backup and store the backup at a remote site for preservation. Enhance various simulation tests of the machine room and emergency drills in order to ensure the normal operation of information system and data security, thereby reducing system interruption risks caused by unexpected natural disasters and human errors, such that the expected system recovery target time can be satisfied. In the future, the Company will perform upgrade on selected systems for system infrastructure, expansion flexibility and disaster recovery, information security, etc. According to the risk level, design is planned and appropriate software/hardware equipment is upgraded. In addition, the storage space of remote data backup is evaluated.
6. The specific managing measurements are as follows: (a) In 2025, the IT department sent at least five newsletters or notifications to all employees, reminding employees to be alert to any abnormal letters and immediately notify IT personnel. (b) The Cyber security manager also arranges information security internal training courses for the IT personnel. In addition, updates and exchanges of the latest information on cyber security from related manufacturers. Two internal trainings for information security were held in 2025. (c) The setting of accounts and related authorities must be approved in advance. (d) An audit for computer system cycle-cyber security was performed in May 2025.