Teollimi

Bureau of Consular Affairs, Ministry of Foreign Affairs (Taiwan) data breach

Bureau of Consular Affairs, Ministry of Foreign Affairs (Taiwan) announced a data breach on Nov 9, 2026 involving up to 72,702 records (duplicates possible), exposing passport numbers. It was caused by a cyberattack. No settlement or compensation has been announced.

Was I affected?

People who uploaded a passport photo online (personally or through a travel agency) between September 3 and November 2, 2026; people whose letters of authorization were verified at the New York office; and online ABTC applicants from September 2026. Counter applications are not affected.

Bureau of Consular Affairs, Ministry of Foreign Affairs (Taiwan) breach facts
AnnouncedNov 9, 2026
When it happenedIntrusion found November 4, 2026
CountryTaiwan
Records exposed (may include duplicates)72,702
Data exposedPassport numbers and Other details
StatusConfirmed by the company or a regulator filing

What happened

Taiwan's Bureau of Consular Affairs (BOCA) found on November 4, 2026 that hackers had broken into some of its websites, and published the details on November 9 and 12. The attackers took 72,702 passport headshot files uploaded through online passport applications between September 3 and November 2, 26,072 scanned letters of authorization verified by the Taipei Economic and Cultural Office in New York since October 2011, and 774 APEC Business Travel Card applications including photos, gender, place of birth and job titles. BOCA says names, ID numbers and passport numbers were not found to be taken, issued passports stay valid and no replacement is needed; it will refer the case to prosecutors.

What should I do?

  1. You do not need to replace your passport; BOCA says issued passports remain valid.
  2. Be suspicious of calls, texts or emails that cite your passport application or use your photo, and verify through BOCA's official website.
  3. Watch for misuse of your photo or identity, such as fake accounts or identity checks you did not start.
  4. Check BOCA's notice page for the dedicated help line it said it will publish.

How Korea fines a breach this size

For comparison, Korea's privacy regulator fined Tiffany Korea ₩2.4 billion (about US$1.6M) in February 2026 over a breach of 4,600 people. Korean law fines the security failure itself, not only misuse of the data.

Data breach fines: Korea vs Japan, the US and Australia →

Know someone who uses Bureau of Consular Affairs, Ministry of Foreign Affairs (Taiwan)? Share this

XFacebookWhatsAppRedditThreadsBlueskyEmail

More data breaches in Taiwan →

Check the other services you use →

Sources