On Friday, May 29th, researchers discovered that details of over 20 Million Taiwanese citizens were being sold in the Dark Web by a Threat Intelligence firm. The seller, Toogod, which is a “well known and reputable threat actor” titled the database as “Taiwan Whole Country Home Registry DB.” The 3.5 GB leaked database comprises details such as full names, Address, ID, Gender, Date of Birth, and other personal information.
According to the actors, the leak was from the Department of Household Registration, Under Ministry of Interior (https://www.ris.gov.tw/).
The seller of the database claims that the leaked information was from 2019. However, as per the analysis of the Threat Intelligence firm, the record was from the year 2008. ‘NULL/empty’ DoB records on the database makes it vigorous to confirm how recent the actual data are.
The Taiwanese Government, however, denied the breach. According to them, the data was just a consolidated database from different sources that have been circulating over the dark web for years.
The Threat Intelligence firm who discovered the breach has acquired the database and will soon be indexed by their developers at AmiBreached.com. They will continue to investigate the said leak and provide more updates as soon as they acquired more information about the hole.
As per relevant Agencies verification, they have found that the data has been circulating since before 2006. Also, there were a total of 29 other data files from 2007 onwards, including seven from 2007, 11 from 2008, three from 2009, five from 2010, two from 2011, and one from 2016. Taiwan’s Cabinet spokesperson reminded the public that purchasing, downloading, or unauthorized use of personal data violates the Personal Data Protection Law.
On the other hand, the Private Security firm updated their post and says that they have shared their findings with Taiwan’s Computer Emergency Response Team (Taiwan CERT) and still currently investigating the issue. They have also shared that the actor has removed the leak from the store’s homepage.