HighII Cyber Warfare & Critical Infrastructure11 November 2026, Wednesday
AI-assisted attack wave in Taiwan exposes a million records
Taiwan's Ministry of Digital Affairs said on 11 November that AI was used in about half of the attacks on more than ten companies and platforms, and that more than a million personal records were affected. The ministry did not name the attackers' location or any state.
Julius Huang of the ministry's Administration for Cyber Security said a preliminary review linked about half of the attacks to AI. According to Dennis Kung, head of the National Institute of Cyber Security, the wave began in mid-September with the first cases in South Korea, and several attacks in Taiwan were detected by 20 October. Some of the attacks used ARTEX, an automated vulnerability scanning tool developed in China. The wave was still under way as of 11 November.
Minister Lin Yi-jing declined to name the affected companies, saying it could hurt their listed shares. In separate statements, e-commerce infrastructure provider 91APP said up to 4.8 million consumers may have been affected, and travel agency ezTravel more than 690,000 members. The ministry did not confirm whether the two companies are included in its own count. No leak of card or payment data has been confirmed in the cases reviewed.
Some of the traffic came from Hong Kong, some from servers in other countries. Kung said all the cases originated abroad; Lin stressed that Hong Kong IP addresses do not reveal the attacker's real location. Digital economy companies must report breaches to the ministry within 72 hours and submit a remediation plan within a month.
On the insurance side, Financial Supervisory Commission data are crucial. Of Taiwan's NT$512 million in cyber premiums in 2025, NT$448 million was for personal data liability cover. The risk this wave has hit is therefore the one policies write most. The state-sponsored attack exclusion only applies once an attack is attributed to a state, and the 11 November statement makes no such attribution. This reading would be falsified by an official state attribution before the 28 November elections.
Talay assessment
Bottom line
The AI-assisted wave that began in Korea has now reached more than a million personal records in Taiwan, and the same toolchain is spreading across the region. Because the ministry has made no attribution, losses stay within data liability policies. The most likely path is a rise in new company disclosures by mid-December, and insurers slowing price cuts at the 1 January renewal.
Likely effects
- Taiwanese internet companiesNegativeWeeks
The costs of 72-hour reporting, customer notification and a one-month remediation plan fall on the more than ten companies affected.
- Cyber insuranceNegative1–6 months
The NT$448 million data liability premium pool could face multiple claims from a single wave; accumulated risk could harden pricing in Asia.
- Fraud riskNegativeWeeks
The ministry says leaked order data lay the ground for new scams through fake LINE customer service accounts posing as retailers.
Possibilities, ranked
- 1More disclosures, no attribution55%
New companies disclose breaches, and losses are met under data liability cover.
Watch: New breach reports filed with the ministry by mid-December
- 2State attribution before the election30%
Some attacks are officially linked to Beijing, opening a debate on exclusions for quasi-public bodies.
Watch: National Security Bureau statements before 28 November
- 3The wave dies down15%
No new cases emerge in early December and the matter closes at the reporting stage.
Watch: The ministry announcing that the wave has ended
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- Personal records affected▼ >1m
- 91APP consumers at risk▼ ≤4.8m
- Data liability share▲ 87.5%