Taiwan Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Taiwan
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Taiwan, checked 7 Nov 2026. Taiwan publishes no cyber threat level; the National Security Bureau releases annual analyses of Chinese cyber activity against critical infrastructure.
Source: National Security Bureau
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
| Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Rise in China-linked attacks on the energy sector | Tenfold | 2025 versus 2024 | National Security Bureau |
| Rise in China-linked incidents against critical infrastructure overall | 6% | 2025 versus 2024 | National Security Bureau |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| BlackTech, Flax Typhoon, Mustang Panda, APT41, UNC3886 | State-aligned | Taiwan's National Security Bureau named these China-linked groups as active against its critical infrastructure. | BleepingComputer | |
| UAT-10362 | Unattributed | Cisco Talos says this group used LucidRook malware against Taiwanese NGOs and universities. | BleepingComputer |
Laws and rules this year
Full stories
Official statements
- 28 Apr 2026Police arrested a student accused of triggering emergency brakes on the high-speed rail through its radio network. BleepingComputer
- 4 Jan 2026National Security Bureau said China-linked attacks on Taiwan's energy sector rose tenfold in 2025. National Security Bureau
Incidents
9 of 9 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ ConfirmedBank SinoPacVia a vendor | 3 Nov 2026 | Finance | Intrusion | None | Confirmed. The bank confirmed that hackers abused a security setting flaw at its new online banking system's foreign vendor to make unauthorised transfers from over 400 accounts. All funds were returned on 3 November. | iThome✓ 8 Nov |
 ✅ Confirmed91APP | 16 Oct 2026 | Retail | Data leak | None | Confirmed. The e-commerce platform disclosed that a Commerce Cloud order database was accessed through an unpatched Appsmith tool, with traces of the ARTEX attack tool. Names, phones and addresses of shoppers at up to 1,329 brands may be affected, including MUJI Taiwan. | iThome · iThome✓ 8 Nov |
 ✅ ConfirmedZeabur | 28 Aug 2026 | Other | Data leak | None | Confirmed. The cloud deployment platform said an internal service credential was misused and customer environment variables, including AI service API keys, were exposed. It told users to rotate keys. | iThome✓ 8 Nov |
| ✅ ConfirmedGovernment agencies (AI agent campaign) | 13 Aug 2026 | Government | Intrusion | None | Confirmed. The Ministry of Digital Affairs said overseas hackers used AI agents such as OpenClaw against government agencies in July, with alerts issued from 20 July. Affected agencies completed their response. Claimed. Researchers at Dream, cited by the Financial Times, said the tool compromised at least 85 government accounts and took over 2,500 personnel records, then moved to the nuclear safety agency and seven energy firms. | Focus Taiwan (CNA)✓ 8 Nov |
| ✅ ConfirmedTeamplus (互動資通), EVERY8D SMS platform | 26 May 2026 | Telecom | Intrusion | None | Confirmed. The EVERY8D enterprise SMS and OTP platform was down for days after a suspected ransomware attack; the technical cause was still under investigation. F-ISAC issued a yellow alert to financial institutions on 26 May. Claimed. On 21 May a seller on a hacker forum offered the company's domain controller accounts and EVERY8D data, including SMS logs. | iThome · iThome✓ 8 Nov |
 ✅ ConfirmedTaiwan High Speed Rail | 5 Apr 2026 | Transport | Not disclosed | None | Confirmed. THSR traced a false General Alarm on its TETRA radio network, which halted four trains for 48 minutes, to a cloned beacon, and police arrested a 23-year-old student on 28 April. | BleepingComputer✓ 7 Nov |
 ✅ ConfirmedASRock Rack (永擎電子)Via a vendor | 20 Jan 2026 | Manufacturing | Intrusion | Confirmed. The listed company disclosed that an outsourced vendor's credentials leaked. It said affected access covered only website data and specific production test programs. Claimed. The Everest ransomware group claimed the company on 20 January. | iThome✓ 8 Nov | |
| ✅ ConfirmedEverlight subsidiary 億力光電 | 19 Jan 2026 | Manufacturing | Intrusion | None | Confirmed. LED maker Everlight disclosed on behalf of its subsidiary that some information systems were hit by a cyberattack and recovery had started. | iThome✓ 8 Nov |
| ✅ Confirmed昭輝實業 (auto plastic parts maker) | 18 Jan 2026 | Manufacturing | Ransomware | None | Confirmed. The company filed a material disclosure saying some computers were intruded on by unknown hackers and some server data was encrypted. It started defence and recovery. | iThome✓ 8 Nov |
FAQ
Does Taiwan have a national cyber threat level?
No published national cyber threat level was found for Taiwan (checked 7 Nov 2026). Taiwan publishes no cyber threat level; the National Security Bureau releases annual analyses of Chinese cyber activity against critical infrastructure.
Which organisations in Taiwan confirmed cyber incidents recently?
9 incidents confirmed since January 2026: Bank SinoPac, 91APP, Zeabur, Government agencies (AI agent campaign), Teamplus (互動資通), EVERY8D SMS platform, Taiwan High Speed Rail, ASRock Rack (永擎電子), Everlight subsidiary 億力光電 and 昭輝實業 (auto plastic parts maker).
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.