ID numbers of 1,573 local election candidates were reportedly held in a non-public query file on the asset-declaration site for about 11 days. The Central Election Commission blamed an outsourced vendor and opened an investigation, and the cybersecurity agency stepped in.
Concerns that the Central Election Commission's (CEC) candidate asset-declaration system may have leaked personal data surfaced on Oct. 28. New Power Party Chair Wang Wan-yu said her team, while compiling an unofficial election gazette from the CEC site, found national ID numbers alongside names and districts in query results. The 1,573 people affected reportedly include 81 mayoral and county magistrate candidates and 1,492 council candidates.
광고 문의 · 300×250According to Newtalk and other outlets, the declarations went online on Oct. 16, so the data was reportedly accessible for about 11 days until it was found on Oct. 27. How many people actually opened the data and how far the exposure extends have not been confirmed. Taiwanese media reported that Taipei Mayor Chiang Wan-an of the Kuomintang and Democratic Progressive Party candidate Puma Shen were on the list.
What the CEC and the cybersecurity agency say
In a statement on Oct. 28 the CEC said the PDF files the public can download have personal data masked, so ID numbers do not appear, and that the site's search conditions and viewing screens do not show them. It said the cause appears to be that an outsourced vendor put the numbers into a non-public query file while producing the announcement data, encoded so the public cannot easily read it. Some outlets quoted the commission as describing it as garbled-looking text.
The Administration for Cyber Security under the Ministry of Digital Affairs said it received the CEC's incident report on Oct. 27. Its preliminary finding is that the site did not properly filter fields when processing and transmitting data, so the ID numbers were loaded into a non-public query file. The agency has sent staff to help test the site's security and assess the impact.
The CEC said it suspended the announcement site on Oct. 27, fixed the program and restored service at 7 p.m. that evening after confirming the risk was blocked. It has also reported the matter to its supervising authority, launched an investigation into the cause and extent, and says it will act under the Personal Data Protection Act.
Demands from opposition parties and civic groups
Wang and members of the Taiwan Advance Coalition asked CEC Chairman Yu Ying-lung to apologize formally to candidates, set up a dedicated contact to notify those affected, audit government websites for similar flaws, and have the preparatory office of the Personal Data Protection Commission investigate. They also urged passage of that commission's organic law. With the elections just over two months away, attention turns to the results of the follow-up inquiry.
