Addressing media reports about a government data breach that affected 130,000 personal data records, the Executive Yuan's Department of Cyber Security said today that it immediately responded by activating data security reviews to pinpoint exact causes.
The department has also conducted year-round information and communication security audits, as well as response and defense drills to deal with possible internet security issues. Using limited resources to create the greatest possible benefit, the department is promoting information security and awareness, and gradually strengthening information security capabilities at all government agencies.
According to the Department of Cyber Security, as soon as contact information for Taiwan citizens abroad was breached, the Ministry of Foreign Affairs' Bureau of Consular Affairs immediately reported an information security incident as required under the Guidelines for Report and Response Operations for National Information and Communication Security. The bureau also implemented remedial measures, setting up a dedicated website that foreign representative offices can use to request emergency contact information for registered Taiwanese travelling abroad.
Fortunately, the recent data leak did not include national identification card numbers, and to ensure that personal data is not misused, the bureau notified members of the public whose data had been breached in accordance with the Personal Data Protection Act. Because the hackers behind this incident employed "onion routing," a technology that enables anonymous communication, tracing the source of the attack will require international cooperation.
The loss of 2,300 records from Taipei City's salary management system primarily involved city government personnel who were also notified as required by the Personal Data Protection Act. Whenever a data security incident occurs at a government agency and personal data is breached, the Department of Cyber Security will direct that agency to determine the root cause of the incident, propose remedial measures, and notify those affected as required by law.