Taiwan consular hack leaks passport photos; issued passports remain valid

Hackers obtained more than 72,000 passport photographs and about 26,000 scanned authorization letters from several websites run by the Bureau of Consular Affairs (BOCA), part of Taiwan's Ministry of Foreign Affairs, the bureau said on 12 November 2026. BOCA said the breach does not affect the validity of passports and authorization letters that have already been issued, and that people do not need to apply for new passports right away.

The bureau apologised for the incident and said the affected websites have been fixed.

Key facts

• 72,702 passport photo files were exposed, uploaded between 3 September and Monday last week
• 26,072 scanned authorization letters verified by Taiwan's representative office in New York were exposed
• 774 APEC Business Travel Card applications submitted online between 1 September and 9 November this year were affected
• Names, dates of birth, national identification numbers and passport numbers do not appear to have been taken
• Issued passports, verified authorization letters and future APEC Business Travel Cards remain valid

What data was exposed?

BOCA said the compromised data fell into three groups. The first is 72,702 passport photo files uploaded through individual online appointments, group applications submitted by travel agencies and conditional online passport renewal applications. Files submitted through the one-stop service at household registration offices or in person at BOCA counters were not included, and other application details — including names, dates of birth, national identification numbers and passport numbers — do not appear to have been obtained.

The second group covers 26,072 scanned authorization letters verified by the Taipei Economic and Cultural Office in New York between 26 October 2011 and Friday last week. Applications submitted in Taiwan, cases handled by other overseas representative offices and other document types, such as birth, death, marriage and academic qualification records, were not affected.

The third group involves 774 applications made through the online system for APEC (Asia-Pacific Economic Cooperation) Business Travel Cards between 1 September and 9 November this year. The exposed information included photographs, application numbers, gender, application categories, places of birth, job titles and recommending agencies. BOCA said key identifying details such as names, passport numbers and contact details were not included, and that cards for all 774 applicants had yet to be issued.

What has BOCA done?

The bureau said it detected suspected hacking attempts on some of its websites on Wednesday last week. It set up a cybersecurity and response task force, isolated the affected servers, assessed the extent of the breach, preserved evidence and notified the competent cybersecurity authorities.

BOCA also arranged alternative procedures so consular services could continue without interruption, and said all affected websites have been restored after software patches and security checks.

What this means for travellers

Travellers who already hold a Taiwan passport do not need to apply for a new one because of the breach, BOCA said, and verified authorization letters remain valid. APEC Business Travel Cards issued in future will also remain valid. Anyone who submitted a passport photo online, had an authorization letter verified in New York or applied for an APEC Business Travel Card during the periods listed above can check which data categories BOCA says were affected.

BOCA has not announced any further steps for affected applicants. The bureau said the leaked data would not affect the validity or use of documents already issued.