Hackers took 72,702 passport photo files from websites run by Taiwan’s Bureau of Consular Affairs, along with tens of thousands of scanned authorization documents and data from hundreds of business travel card applications, the bureau said in an updated notice on the intrusion.
The bureau, part of the Ministry of Foreign Affairs, said it began finding signs that some of its websites had been hacked on the afternoon of November 4. It set up a response team, isolated the affected servers, preserved evidence, notified the cybersecurity authorities and arranged alternative procedures to keep consular services running. The websites were brought back online after software repairs and security testing.
The passport photos had been uploaded between September 3 and November 2 through the bureau’s individual online appointment system, group applications filed by travel agencies, and its conditional online passport renewal service. Applications made in person or through the one-stop service at household registration offices were not affected. The bureau said it has so far found no sign that names, dates of birth, national identification numbers or passport numbers from those applications were taken.
The intruders also obtained 26,072 scanned powers of attorney authenticated by Taiwan’s representative office in New York between October 26, 2011 and November 6, 2026. Data from 774 applications made through the online form for the Asia-Pacific Economic Cooperation Business Travel Card between September 1 and November 10 was exposed as well, including applicant photos, application numbers, gender, application category, place of birth, job title and recommending agency, but not names, passport numbers or contact details.
The bureau apologized and urged people who used those services during the affected periods to watch for misuse of their personal data. It said the stolen photos and documents do not affect the validity of passports already issued, so holders do not need to replace them, and that authenticated documents and future APEC Business Travel Cards remain valid. It plans to announce a dedicated inquiry channel and support measures.
The bureau said it will seek compensation from any contractor found to have failed to meet its contractual cybersecurity obligations, review its information systems and outsourcing management, and refer evidence to judicial authorities, saying the intrusion may violate the Criminal Code and the Personal Data Protection Act.
Sources: Bureau of Consular Affairs, Taiwan News
–
By the ID Tech Editorial Team
