Foreign Ministry bureau hacked, exposing more than 72,000 passport photos and 26,000 authorization documents
Investigation also finds 774 ABTC applications accessed; bureau says no major identity or passport information has been found among the leaked data and the public does not need to replace passports immediately
Some websites operated by the Ministry of Foreign Affairs' Bureau of Consular Affairs were hacked, resulting in the exposure of more than 72,000 passport application photos and 26,000 scanned authorization documents. The bureau released its investigation findings on Nov. 12 and apologized, stressing that it has so far found no evidence that critical application data, including passport numbers or national identification numbers, was accessed. Passports that have already been issued remain valid and can be used normally, and the public does not need to apply for replacements immediately.
According to a Central News Agency report, the bureau began discovering on the afternoon of Nov. 4 that some of its websites may have been breached. It immediately formed a cybersecurity and incident-response task force, isolated the relevant servers, preserved evidence and notified the competent cybersecurity authorities.
The investigation found that the accessed data fell into three categories. The first consisted of 72,702 passport photo files uploaded between Sept. 3 and Nov. 2 through personal online appointments, group applications submitted by travel agencies and some online passport renewal and replacement channels. The bureau said it has not found evidence that application data associated with the photos—including names, dates of birth, national identification numbers or passport numbers—was accessed.
The second category comprised 26,072 scans of authorization documents verified by the Taipei Economic and Cultural Office in New York between Oct. 26, 2011, and Nov. 6, 2026. The data did not include applications processed in Taiwan or related documents held by other overseas missions.
The third category involved partial data from 774 applications submitted through the online application system for the Asia-Pacific Economic Cooperation Business Travel Card (ABTC) between Sept. 1 and Nov. 9. The data included applicants' photos, application numbers, gender, application category, place of birth, job titles and recommending organizations.
The bureau said the 774 records did not contain critical information that could directly identify applicants, such as their names, passport numbers or contact details. The corresponding ABTC cards had also not yet been issued.
The bureau said the affected websites have undergone code repairs and security testing and are gradually being restored. It apologized for the exposure of some application data and the concern and anxiety the incident may have caused, adding that response measures had been implemented.
The bureau stressed that the accessed passport photos and authorization document scans do not affect the validity or normal use of passports that have already been issued. People do not need to reapply for passports immediately because of the incident. The validity of the relevant authorization-document verifications and the future use of ABTC cards will also not be affected.
The incident highlights the importance of cybersecurity protection and personal-data management on government online service platforms. Attention will now turn to whether the authorities can further determine how the breach occurred, who was responsible and whether the data was made public or offered for resale.