Database has now been removed from underground marketplace, researchers have confirmed
UPDATED Sensitive personal data apparently belonging to more than 20 million Taiwanese citizens has appeared on a darknet marketplace, a threat intelligence outfit has claimed.
In a blog post published on May 29, Cyble said an underground retailer of data breach spoils – “known and reputable” in terms of the data’s authenticity – had named the source of the leak as the Ministry of the Interior’s Department of Household Registration.
However, the Taiwanese Government has denied the breach, claiming that the data was consolidated from several sources and has been circulating on the dark web for several years.
20 million records
The 3.5 GB database contained citizens’ full names, postal addresses, phone numbers, government IDs, genders, and dates of birth, according to Cyble.
“A few weeks ago, our researchers came across a leaked database on the dark web where a known and reputable actor ‘Toogod’ dropped the database of ‘Taiwan Whole Country Home Registry DB’ comprising of 20 Million+ records,” said the company.
Taiwan’s population currently stands at 23.8 million.
Cyble says it has so far been unable to confidently estimate when the data breach took place.
“According to the actor, the leak is from 2019,” they said. “Our preliminary analysis noted the last DOB record was from 2008.
“However, it should be noted that there are certain records with ‘NULL/empty’ DoB records, hence it’s hard to confirm how recent it is.”
‘Before’ and ‘after’ screenshots in the blog post show that the database has now been removed from the seller’s darknet store.
However, Cyble says it had already acquired the database and plans to index the data in its data breach search engine, AmiBreached.com.
READ MORE Data breach at Indian learning platform Unacademy exposes millions of user accounts
Cyble updated its blog post today (June 2) to say it has shared its findings with Taiwan’s Computer Emergency Response Team (Taiwan CERT) and is still investigating the leak.
If Cyble’s observations had been verified, the leak would have ranked among the largest-ever government data breaches.
A comparable breach, in terms of being such a large proportion of a country’s population, was the exposure in 2015 of similarly sensitive personal data belonging to 191 million US voters in a misconfigured, publicly facing database.
This article has been updated with a comment from The Taiwan government.
