Taiwan government mega-breach feared as trove of 20m citizens’ data found on dark web

Database has now been removed from underground marketplace, researchers have confirmed

UPDATED Sensitive personal data apparently belonging to more than 20 million Taiwanese citizens has appeared on a darknet marketplace, a threat intelligence outfit has claimed.

In a blog post published on May 29, Cyble said an underground retailer of data breach spoils – “known and reputable” in terms of the data’s authenticity – had named the source of the leak as the Ministry of the Interior’s Department of Household Registration.

However, a spokesperson for Cyble told The Daily Swig that this claim was, as of yet, still “unconfirmed”.

20 million records

The 3.5 GB database contained citizens’ full names, postal addresses, phone numbers, government IDs, genders, and dates of birth, according to Cyble.

“A few weeks ago, our researchers came across a leaked database on the dark web where a known and reputable actor ‘Toogod’ dropped the database of ‘Taiwan Whole Country Home Registry DB’ comprising of 20 Million+ records,” said the company.

Taiwan’s population currently stands at 23.8 million.

Cyble says it has so far been unable to confidently estimate when the data breach took place.

“According to the actor, the leak is from 2019,” they said. “Our preliminary analysis noted the last DOB record was from 2008.

“However, it should be noted that there are certain records with ‘NULL/empty’ DoB records, hence it’s hard to confirm how recent it is.”

‘Before’ and ‘after’ screenshots in the blog post show that the database has now been removed from the seller’s darknet store.

However, Cyble says it had already acquired the database and plans to index the data in its data breach search engine, AmiBreached.com.

Cyble updated its blog post today (June 2) to say it has shared its findings with Taiwan’s Computer Emergency Response Team (Taiwan CERT) and is still investigating the leak.

If Cyble’s observations are verified, the leak would rank among the largest-ever government data breaches.

A comparable breach, in terms of being such a large proportion of a country’s population, was the exposure in 2015 of similarly sensitive personal data belonging to 191 million US voters in a misconfigured, publicly facing database.

The Daily Swig has contacted The Taiwan Ministry of Interior and Taiwan CERT for further comment.