CEC Case Was Coding Flaw, 32 IP Addresses Under Investigation
The Legislative Yuan Transportation Committee reviewed the budget proposals for the Ministry of Digital Affairs and the National Communications Commission, with Minister Lin Yi-jing leading officials to report and answer questions. Regarding the leak of sensitive personal data including ID numbers of multiple mayoral and councilor candidates from the Central Election Commission's public official candidate property declaration system for 11 days, Lin clarified that from a technical perspective it was not an external hacker attack, but an avoidable error by the vendor when writing the web program, a flaw in the project software itself.
Administration for Cyber Security Director-General Tsai Fu-long added that after the incident a third-party forensics unit is making every effort to trace the sources of 32 downloading IP addresses, and the Administration for Cyber Security has introduced AI source-code detection tools to help the CEC inspect and strengthen system vulnerabilities. Lin promised to aim at establishing Uni-President unified defense and detection standards to prevent administrative agencies' personal data from being exposed to risks again.
91APP Penetrated by ARTEX, About 5 to 6 E-commerce Firms Affected
Regarding the suspected personal data leak from attacks on 91APP and other e-commerce platforms, Lin explained that according to the administrative investigation, the main cause was that the companies internally used two open-source software programs without timely installing the latest security patches. The investigation also confirmed that 91APP and the victimized e-commerce firms were indiscriminately scanned and penetrated by ARTEX, an Agentic AI automated attack tool developed in China. The same tool recently also victimized multiple financial institutions in Japan and South Korea.
Currently the Ministry of Digital Affairs has identified and is investigating about 5 to 6 key affected e-commerce firms, and requires companies to update patches immediately upon receiving cybersecurity alerts. Regarding the Bank SinoPac illegal transfer incident, Lin said the case involved software from a major foreign vendor, possibly due to unpatched known vulnerabilities or new attack methods. The Administration for Cyber Security has dispatched personnel to assist the Financial Supervisory Commission in the investigation, and will subsequently use AI tools to proactively conduct security testing for financial institutions.
Satellite Resilience Shifts to Leo, Strengthening Deepfake and Geospatial Data Protection
On communications resilience, Lin revealed that because Starlink assessed Taiwan's 4G/5G coverage at 99.9% and has low willingness to land in Taiwan, the Ministry of Digital Affairs has shifted to cooperating with Amazon Leo low-orbit satellites, and completed high-latitude field tests in Australia. Of the planned 2,200 terminal sites, 40% will be allocated to local governments for extreme-disaster rescue needs.
In countering AI disinformation, regarding the case of Taipei mayoral candidate Shen Boyang being smeared by AI deepfake audio, after the case was transferred the Ministry of Digital Affairs completed cross-platform takedowns in only 73 minutes, but front-end police forensics and reporting procedures took 6 days, and the Ministry is coordinating to establish encrypted and expedited forensic mechanisms. Regarding foreign disinformation with Facebook accounting for 70% and a doubled share on Threads, it will implement three principles of proactive disclosure by uploaders, technical labeling by platforms, and referral for prosecution for non-disclosure. The National Institute of Cyber Security has obtained U.S. government approval to cooperate with four major AI companies Anthropic, OpenAI, Google, and Microsoft on automated vulnerability scanning. Household registration and health insurance systems will introduce AI detection tools starting in December, and high-precision geographic map controls and AI Basic Act risk guidelines are under study.