LowII Cyber Warfare & Critical Infrastructure28 October 2026, Wednesday · 08:15 TRT (UTC+3)
Taiwan election commission file carried ID numbers of 1,573 candidates
Taiwan's Central Election Commission took down its asset declaration site for candidates in the 28 November local elections on 27 October to apply a security patch. An alliance of 4 small parties says the ID numbers of 1,573 candidates were accessible for 11 days; the commission maintains the numbers were stored in unreadable form.
According to the Taipei Times on 29 October, the data were published on 16 October together with the asset declarations of mayoral and council candidates. Those affected include Taipei Mayor Chiang Wan-an and his main rival, DPP legislator Puma Shen. A candidate from the alliance said the data stayed exposed for 11 days until the commission was alerted, and that no one knows how many times they were downloaded. The alliance warned that ID numbers combined with names, dates of birth and constituencies open the door to identity theft and fraud, recalling that 23 million household registration records leaked to online forums in 2022.
United Daily News reported at 13:15 on 28 October that the commission's initial finding is that an outside contractor mistakenly placed the ID numbers in a non-public query file. The commission says the numbers were stored as garbled characters and did not appear in public PDFs or on query screens. The site was taken down on 27 October and reopened at 19:00 the same day after the fix. The commission reported the incident to its supervising authority and opened an investigation under the personal data protection law. How many people actually read the data could not be verified.
Talay assessment
Bottom line
This was not an attack but a data exposure caused by a contractor error. Still, with a month to go before the 28 November election, it touches the credibility of the electoral body. The commission's unreadable-characters defence and the alliance's claim of 11 days of access contradict each other, and neither can be verified until the investigation ends. The most likely path is that the episode stays confined to contractor oversight and a review of public websites.
Likely effects
- Electoral credibilityNegativeWeeks
A data error by the electoral body a month before the vote hands disinformation campaigns concrete material and raises the commission's burden of explanation.
- Public IT contractorsUncertain1–6 months
The contractor's error puts oversight of outsourced data work on government websites, and liability under the personal data law, on the agenda.
- Candidate securityNegativeWeeks
If the ID numbers of 1,573 candidates are combined with names and dates of birth, the risk of identity theft and targeted fraud arises.
Possibilities, ranked
- 1Contained administrative incident60%
The investigation confirms the contractor error, the commission announces new oversight steps and no evidence of misuse emerges.
Watch: The outcome of the commission's investigation and any sanction against the contractor
- 2Misuse of the data25%
Cases of fraud or identity theft targeting candidates are reported, and the incident becomes a political issue in the campaign.
Watch: Candidates reporting fraud or misuse of their identity to the police
- 3Wider exposure15%
Further review finds similar personal data exposures on other public websites.
Watch: A government statement on security scans of public websites
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Candidates affected▼ 1,573
- Exposure period▼ 11 days