On 11 November 2026, Taiwan's Ministry of Digital Affairs (MODA) said nearly half of recent cyberattacks on more than 10 Taiwanese businesses and online platforms involved AI. The attacks exposed more than 1 million personal records, including names, phone numbers, email addresses and order details, according to Focus Taiwan's report of the briefing. Officials said some attacks used ARTEX, a Chinese-developed automated tool for probing security weaknesses. MODA also reminded digital-economy firms of two duties: report a breach within 72 hours of becoming aware of it, and file an improvement plan within one month. Minister Lin Yi-jing added that firms could face liability if leaked order data leads to fraud losses.
The strongest case for MODA's approach
The regulator's logic is easy to defend. Julius Huang of MODA's Administration for Cyber Security described the threat this way: "AI helps hackers automatically find doors and try keys." Automation makes weak passwords and unpatched software cheaper to exploit at scale. The harm also does not stop at the breach. Deputy Director-General Huang Ya-ping warned that scammers could use leaked order details to impersonate retailers and steer consumers to fake LINE customer-service accounts. If a company's delay lets that fraud run, a rule that makes the company share the cost has a clear rationale. Fast notification limits the damage, and the improvement-plan requirement pushes firms to fix root causes instead of quietly moving on.
This is a continuation, not a new alarm
MODA has been tracking AI-assisted attacks all year. In its 13 August 2026 release, the Administration for Cyber Security said overseas attackers mixed human operators with AI agents, which it named as Open Claw. According to that release, the agents chained several techniques together and used backup and test systems as stepping stones, making the attacks fast, cheap and large in scale. MODA said affected government units had finished their response. On 4 September, the Administration published Taiwan's Policy for Addressing Frontier AI Cybersecurity Risks. It created a cross-ministry task force and set a short-term goal of shortening the time from vulnerability discovery to remediation. The commercial-sector warning is the same policy applied to private firms. The attack tooling got faster, so the response clock got shorter.
Where proportionality gets tested
The 72-hour window is reasonable. It is also the best-known benchmark in breach regulation, borrowed from the GDPR, and a firm that has logs and a response plan can meet it. Two other parts of the announcement are less settled.
First, the legal basis for the private-sector duties. Taiwan passed major amendments to its Personal Data Protection Act that were promulgated on 11 November 2025. As Jones Day's summary describes them, Article 12 requires notice to data subjects, and requires notice to the authority when a breach is a "reportable incident" under separate regulations. Jones Day's note predates today's date, and it said the amendments had not yet taken effect. We could not confirm from the sources reviewed which instrument sets the 72-hour clock for digital-economy businesses. Firms deserve a clear, published answer to that question, including what counts as "becoming aware."
Second, and more important, the fraud-loss liability warning. Lin said companies could face legal liability if breaches lead to fraud losses, according to Focus Taiwan. She did not say whether consumers could seek compensation for exposure of personal data alone. That gap matters. A liability standard tied to negligence is useful: it rewards firms that patch, use multi-factor authentication and monitor their systems. A standard tied only to the fact that a breach occurred is a different thing. Defenders cannot prevent every AI-accelerated intrusion, so strict liability would punish firms that did everything right. It would also give them a reason to delay or soften disclosure, which is the opposite of what the 72-hour rule wants.
Disclosure, attribution and restraint
Lin declined to name the affected businesses. She said naming them could cause financial and reputational damage, and for listed companies could move share prices. That is a defensible call during an ongoing wave. Focus Taiwan reported that the wave began around mid-September, with early cases in South Korea, and that it is still going. Naming firms mid-incident can tip off attackers and hurt customers who have not yet been told. But the regulator should then publish aggregate detail: which sectors were hit, what the common weakness was, and how long firms took to report. That serves the public without exposing individual victims.
Lin also cautioned that traffic traced to Hong Kong IP addresses does not show where attackers are. That is a sound restraint. Attackers route through servers in many countries, and officials said the cases seen so far came from overseas. Policy should rest on what defenders can verify, such as tooling, techniques and exposed weaknesses, not on guesses about where an IP address sits. The ARTEX mention is a useful reminder that tool provenance is not attribution either. Automated testing tools are dual-use, and defenders run them too.
What good policy looks like from here
Three steps would keep Taiwan's response proportionate and effective.
- Publish the legal basis. Say which provision sets the 72-hour and one-month duties, what triggers them, and what penalties apply.
- Adopt a negligence-based liability test. Tie fraud-loss liability to whether a firm met baseline security practices, with safe harbour for firms that report promptly and follow the remediation plan.
- Share the lessons. Release anonymised post-incident findings so smaller firms can fix the same weak passwords and unpatched software without waiting for their own breach.
Taiwan is right that AI has shortened the time between a vulnerability and an exploit. The best response is clear, fast, fair rules that reward diligence. Liability uncertainty that makes firms afraid to disclose would work against that goal.