Taiwan links the attacks to AI, not a state, leaving cover open

Noise in the attack count, signal in the record type

In a 21 October report, Taiwan's National Security Bureau said the government service network faced 185.6 million attack attempts in July. That works out at 2.58 million a day and alone exceeds the total for the first quarter. The figure makes a good headline, but it counts scans and blocked probes; it does not say how many systems were breached.

The real data came on 11 November. The team of Minister of Digital Affairs Lin Yi-jing said a wave that began in mid-September had reached more than ten companies, and that about half of the attacks used AI. More than a million personal records were affected. E-commerce infrastructure provider 91APP said up to 4.8 million consumers may have been affected, and online travel agency ezTravel more than 690,000 members. The ministry did not confirm whether the two firms are in its own count.

The wave's tool is not new. The ministry says some attacks used ARTEX, an automated vulnerability scanning tool developed in China, and that the first cases appeared in South Korea. The Hacker News reported on 5 November that 1,645 servers were exposing ARTEX consoles as of 4 November. A backdoored copy of the tool ran on 62 consoles between 2 and 4 November, 17 of them in Hong Kong and 7 in China.

The policy covers exactly what was stolen

Financial Supervisory Commission data cited by Insurance Business on 23 September put Taiwan's cyber premiums at NT$512 million in 2025. Of that, NT$448 million, or 87.5%, covers third-party liability arising from personal data leaks. Comprehensive cyber packages bring in only NT$46 million and unauthorised access cover NT$18 million. There are 16 insurers in the market, and 28.87% of premiums come from semiconductor companies.

That structure matches where the wave has struck. No leak of card or payment data has been confirmed in the 11 November cases; the losses are personal data and order details. What was stolen, in other words, is the risk Taiwanese policies write most. Business interruption and ransomware cover barely approach 9% of premiums, so the bill for an attack that halts a production line would largely stay on the balance sheet.

Banking looks different. SinoPac disclosed on 4–5 November that 427 unauthorised transfers belonging to 418 customers had been made through its new mobile banking system, totalling NT$41.76 million. The bank reimbursed customers and said it would seek compensation from an overseas supplier. Whether this loss was covered by a policy could not be verified; the amount equals about 8% of the market's annual premiums for 2025.

The attribution gap keeps cover in play

In the Lloyd's market, standalone cyber policies must carry a state-sponsored attack exclusion; non-compliant wording cannot be used on new or renewing business. For the exclusion to apply, an attack must be attributed to a state. According to a 23 September Insurance Business analysis, the debate in Taiwan turns on how attribution will be proven and whether policyholders will be left waiting meanwhile.

The 11 November statement deliberately left that question open. Dennis Kung, head of the National Institute of Cyber Security, said all the cases came from abroad. Minister Lin warned that Hong Kong IP addresses do not reveal the attacker's real location. On 7 October CrowdStrike assessed with moderate confidence that the actor behind the Korean wave was Chinese-speaking and financially motivated; that profile points to crime, not a state.

For insurance the outcome is paradoxical. As long as attribution stays unclear, data liability cover responds and losses pass to insurers. Yet the same National Security Bureau does not rule out that the surge ahead of the 28 November local elections is part of a Beijing interference plan. If an official state attribution comes, the exclusion debate will reach the field for the first time at quasi-public bodies.

Three thresholds to watch until 28 November

The first is the reporting calendar. Digital economy companies must report breaches to the ministry within 72 hours and submit a remediation plan within a month; new company disclosures by mid-December will show the breadth of the wave. The second is the language of attribution. If the National Security Bureau or the ministry ties the attackers to a state before the 28 November elections, the reading of cover changes.

The third is price. Marsh's third-quarter 2026 data showed cyber pricing in Asia down 6%; the waves in Taiwan, Korea and Japan could halt that decline at the 1 January renewal. If they do not, ample capacity is pushing insurers to chase volume rather than defend data liability pricing.