Attackers broke into several websites run by the Bureau of Consular Affairs (BOCA), part of Taiwan's Ministry of Foreign Affairs. The bureau says they took 72,702 passport photo files, 26,072 scanned letters of authorization and data from 774 APEC Business Travel Card applications. BOCA disclosed the breach on 12 November and apologised. It says passports already issued remain valid and holders do not need to apply for new ones. A day later, Cyber Security Administration Deputy Director-General Chou Chih-ho said about 8 million personal-data records had been affected. That figure covers a wave of attacks on Taiwanese organisations over recent weeks, not BOCA alone. Some coverage has attached the 8 million number to the consular breach. The bureau's own figures add up to roughly 99,500 files and applications.
What Happened
According to its statement, reported by the Central News Agency (CNA), BOCA spotted suspected intrusions on some of its websites on the afternoon of 4 November. It set up an incident-response task force, isolated the affected servers, preserved evidence and reported the incident to Taiwan's cybersecurity authority. The Cyber Security Management Act requires government agencies to file that report. Chou confirmed the bureau had done so.
BOCA says the affected sites have been fixed, passed security testing and are back online. It also put contingency plans in place to keep consular services running. The bureau has not said how long the attackers had access before 4 November.
The consular breach is one of several recent incidents in Taiwan. The Taipei Times lists the Taipei Geotechnical Engineering Office's Facebook account, the travel agency ezTravel, Bank SinoPac and the software firm 91APP as separate cases over the past two months. On 11 November the Ministry of Digital Affairs (MODA) said attacks on more than 10 businesses and online platforms had affected over 1 million records. Chou's figure of about 8 million came a day later and appears to cover a wider set of incidents. Officials have not published a breakdown of either number.
What Was Taken
BOCA describes three groups of compromised data:
- Passport photos: 72,702 photo files uploaded between 3 September and 2 November 2026. They came in through individual online appointments, group applications filed by travel agencies, and conditional online passport renewals. Photos from in-person applications at BOCA counters or household registration offices were not affected. Some early reports rounded this to "70,000".
- Authorization letters: 26,072 scanned letters of authorization verified by the Taipei Economic and Cultural Office in New York. Reports disagree on when this period starts. The Taipei Times gives 26 October 2011. Focus Taiwan, CNA's English service, gives 26 October 2021. Both say it ends on 6 November 2026. Accounts differ, and BOCA's original release has not been checked against either. Documents processed in Taiwan or at other overseas offices were not affected, and neither were birth, death, marriage or academic records.
- APEC Business Travel Card applications: 774 online applications submitted between 1 September and 9 November. Exposed fields include photographs, case numbers, gender, application type, place of birth, job title and the name of the recommending agency.
BOCA says it has found no sign that names, dates of birth, national ID numbers or passport numbers were taken with the photos. Note the wording: the bureau says this data "did not appear" to have been obtained. That is not the same as confirming it was not. Authorization letters are scanned documents, and they are likely to contain names, signatures and identity details on the page. BOCA has not described what the letters contain.
Why It Matters
A recent passport photo is not much use on its own. Linked to other data, it becomes valuable for identity fraud, deepfake-assisted verification bypass and building profiles of travellers. The ABTC records are a particular concern. They link photos to job titles, places of birth and sponsoring agencies for business travellers who frequently cross borders in the Asia-Pacific region. That makes them useful for intelligence targeting, whatever the attacker's original motive.
The breach also fits a wider pattern. MODA says nearly half of the recent attacks on Taiwanese businesses involved AI tools. The National Institute of Cyber Security says the current wave started around mid-September, with first cases in South Korea, and is still going on. Government sites that accept public uploads, such as photo portals, document scanning and appointment systems, often keep large stores of identity images on servers facing the internet. They are likely targets for automated scanning.
The Attack Technique
BOCA has not said how the attackers got in. No official has publicly linked the consular breach to a specific actor, tool or vulnerability.
The context below comes from statements about the broader wave. None of these sources ties it to BOCA:
- MODA says some of the recent attacks on businesses used ARTEX, an automated vulnerability-testing tool developed in China, and that some attack traffic appeared to come from Hong Kong. Officials described attackers using AI to find and exploit weak passwords and unpatched software faster and more cheaply.
- The Taiwan Information Security Association describes a July campaign against government systems using the Hermes and OpenClaw AI agent frameworks. The attackers mapped public APIs and login pages, got usable identities through weak passwords, unauthorized APIs and flaws in JWT verification, then used single sign-on to reach internal services.
- Acronis's Threat Research Unit reports a single operator running a 12-agent AI system it calls "BOSSAI" against hundreds of organisations in 11 countries, including Taiwanese emergency services. Acronis does not name any specific affiliation and suggests the motive is probably financial.
Whether the consular breach belongs to any of these campaigns is unconfirmed.
What Organizations Should Do
- Inventory every upload and document-intake endpoint. Include testing, backup, outsourced and travel-agency partner portals. These are the systems most likely to hold large image stores that nobody is watching.
- Test APIs and identity checks from an attacker's position. Probe with no login and with low-privilege accounts. Check JWT signatures, issuer, audience and expiry. Find out where single sign-on lets one compromised account reach other applications.
- Cut retention. Move uploaded identity photos and scans off servers facing the internet once processing is done. BOCA's breach reached authorization letters going back at least five years and possibly fifteen.
- Remove weak and default credentials, and patch the edge. MODA says AI-assisted attackers are going after exactly these gaps at scale.
- Watch for automated scanning patterns. Look for high-volume, systematic probing of login pages and APIs, the kind agent-driven tools produce, and alert on bulk reads from file storage.
- Prepare for photo-based fraud downstream. Banks, telecoms and other organisations that verify identity using passport images should tighten liveness and document checks for Taiwanese applicants.
Sources: Hack affects 8 million records: official - Taipei Times | Passport photos, authorization letters leaked in BOCA hack - Taipei... | Passport validity unaffected by data breach of 70,000 headshots: BO... | Foreign Ministry bureau hacked, exposing more than 72,000 passport... | Taiwan consular hack leaks passport photos; issued passports remain... | Nearly half of recent cyberattacks on Taiwan firms AI-linked: MODA... | ⑤ Hermes and OpenClaw: How API and identity flaws exposed governmen... | BOSSAI: Inside the AI attack mesh that targeted Taiwan’s emergency...