ID WOES: A Bureau of Consular Affairs investigation found that 72,702 passport photos uploaded to its Web site were affected by hackers, as were letters of authorization
- By Chung Li-hua and Jonathan Chin / Staff reporter, with staff writer and CNA
About 8 million personal-data records were affected in a spate of attacks over the past few weeks, a top cybersecurity official said yesterday, as the Bureau of Consular Affairs revealed that hackers had compromised 70,000 passport photographs.
Cyber Security Administration Deputy Director-General Chou Chih-ho (周智禾) told reporters at a post-Cabinet meeting news conference in Taipei that hackers were increasingly using artificial intelligence to carry out attacks worldwide.
The Ministry of Digital Affairs on Wednesday urged Taiwanese companies to plug security gaps in their systems, inform consumers of data breaches and reduce the amount of personal information they collect, he said.
Computer code is displayed on screens in an illustration photograph taken on on Oct. 22.Photo: Reuters
Chou’s remarks came hours after the bureau revealed that hackers compromised more than 70,000 passport photographs and scanned copies of 26,000 letters of authorization.
The Taipei Geotechnical Engineering Office’s Facebook account, online travel agency ezTravel, Bank SinoPac and software services company 91APP have been involved in separate cybersecurity incidents over the past two months.
The Cyber Security Management Act (資通安全管理法) stipulates that government agencies and designated non-governmental organizations must report cybersecurity incidents to the authorities, Chou said.
The bureau and the Geotechnical Engineering Office have informed the Cyber Security Administration of the attacks on their systems as required, he added.
Privately owned enterprises not subject to the act are obliged to report personal-data breaches to their industry regulators, which would notify the ministry and other authorities, he said.
The ministry is assisting ezTravel, Bank SinoPac, 91APP and other companies targeted by cyberattacks as needed, he said.
The ministry participated in meetings concerning the three private-sector cybersecurity incidents, Chou said.
The bureau apologized for the passport-data breach, saying it had taken emergency measures.
Passport holders do not need to apply for replacements, it added in a statement.
The bureau said it discovered the breach on Wednesday last week and immediately formed a task force to isolate the affected servers, investigate, preserve evidence and report the breach to information security authorities.
It also made contingency plans to ensure its services would not be disrupted, it said, adding that affected Web sites have been restored after passing security tests.
Its investigation found that 72,702 headshots uploaded to the bureau’s Web site through personal online appointments, travel agency group applications and conditional online passport application services between Sept. 3 and Monday last week were compromised, it said.
Applicants who submitted their applications in person at service counters were not affected, it said.
The compromised data also included 26,072 scanned letters of authorization verified by the Taipei Economic and Cultural Office in New York between Oct. 26, 2011, and Friday last week.
Authorization documents processed domestically or through other overseas offices were unaffected, as were birth, death, marriage and academic documents, it said.
The breach also involved 774 online applications for APEC Business Travel Cards (ABTCs) submitted between Sept. 1 and Monday.
The compromised information included photographs, case numbers, gender, application types, places of birth, job titles and the names of recommending agencies, the agency said.
However, applicants’ names, passport numbers and contact information was not among the leaked data, the bureau said.
The ABTCs associated with the compromised applications had not yet been issued, and the incident would not affect their issuance or subsequent use, it said.