Wang Wan-yu Accuses Central Election Commission of Data Leak! Were the ID Numbers of More Than a Thousand Candidates, Including Chiang Wan-an and Puma Shen, Exposed?

With the 2026 local elections approaching, Wang Wan-yu, chair of the New Power Party, posted today (10/28), alleging a serious personal data leak in the Central Election Commission’s “Public Officials and Candidates Asset Declaration System.” The ID numbers of more than a thousand candidates, including Chiang Wan-an and Puma Shen, were exposed.
The Central Election Commission said its preliminary assessment was that the incident resulted from an outsourced contractor’s operational error. The relevant files appeared as garbled text and could not be read by the general public. An investigation has been launched.
Wang Wan-yu: Central Election Commission data leak exposed candidates’ ID numbers for 11 days
Wang Wan-yu said that the ID numbers of 1,573 candidates for county and city mayor and councilor positions across Taiwan this year—including Chiang Wan-an and Puma Shen—were posted online.
She said the personal data leak was discovered by chance. After the Central Election Commission's website went public on October 16, they used it to build a civilian version of the election bulletin. On the 27th, they found that the data accessible through the search function included national ID numbers, which anyone could download without an account or password.
They later cross-checked the information of Taiwan Forward Alliance candidates and confirmed that the ID numbers were real. They immediately notified the Central Election Commission by phone and official letter. The Commission has since removed the personal data from its website, but it had been exposed for 11 days, from the time it was posted until the 27th. There is no way to know whether anyone accessed or took the data.
In response, the Taiwan Forward Alliance held a press conference today. Four affected candidates—Wu Hsin-tai, Lee Hui-hsuan, Kan Chung-wei, and Hsieh Min-hung—attended and put forward four demands, including an apology from the Central Election Commission chairperson and the release of an investigation and improvement report; a comprehensive audit of government websites by the Ministry of Digital Affairs; and the swift passage by the Legislative Yuan of the Personal Data Protection Commission Organization Act.
Wang Wan-yu pointed out that although amendments to the Personal Data Protection Act passed their third reading last October, the Personal Data Protection Commission has yet to be established, and the new law has not taken effect. The old law therefore remains in force.
Central Election Commission: Preliminary assessment points to negligence by contracted vendor; investigation launched
In response to questions raised at the press conference, the Central Election Commission said that the asset declarations published on October 16 were presented as PDF files with personal data redacted. The downloaded PDFs did not contain ID numbers, nor did the search criteria or viewing interface. It was not the case that anyone who opened the search page could access the information.
According to a report by the Central News Agency, the Commission's preliminary assessment was that the contracted vendor included ID numbers in a non-public search file when producing the published data. The file displayed the numbers in encoded form that could not be read by ordinary people.
The Central Election Commission said it had suspended the website service on the 27th, had maintenance staff check the issue and fix the program, and reopened the search service at 7 p.m. It also notified the competent authority.
The Central Election Commission has launched an investigation into the cause of the vendor's negligence and the scope of its impact, and will proceed in accordance with the Personal Data Protection Act.
On the other side of the Pacific, the U.S. Federal Election Commission system is hacked
On the other side of the Pacific, the U.S. midterm elections are also approaching, and a cybersecurity incident has occurred there as well.
According to a Reuters report, the U.S. Federal Election Commission's (FEC) electronic filing system went down at around 10 p.m. Eastern Time on the 26th. An internal FEC email said that a malicious actor had attempted to break in.
In the week before the November 3 midterm elections, political groups were unable to submit 24-hour and 48-hour expenditure reports, which are a key way to track the flow of money in the final days before an election. However, past reports remained searchable on the website. The FEC is also not responsible for counting votes or administering elections, so voting was unaffected.
Politico quoted people familiar with the matter as saying that the breach was limited in scope and that the team detected it early and shut down the affected system. However, no one knows who was behind it, and the attacker may have used an advanced AI model with hacking capabilities.
Related reading:
Is Coinbase's website blocked in Taiwan? New Taipei court says it may violate the Election and Recall Act; tests show it cannot be accessed on mobile networks

Reuters poll: More than 60% of Americans oppose election betting; prediction markets may undermine confidence in the integrity of elections
The article “Wang Wan-yu accuses Central Election Commission of personal data leak! Were the ID numbers of over 1,000 candidates, including Chiang Wan-an and Shen Po-yang, exposed?” was first published by “Crypto City”