Glossary term
DDoS attack
A DDoS attack is a distributed denial-of-service attack, where many machines work together to flood one target so that legitimate users cannot reach it.
Read more
Significant cyber incident
Cyberattacks on Taiwan during the August 2022 Pelosi visit
In short
On 2 August 2022, as US House Speaker Nancy Pelosi arrived in Taiwan, government agencies reported an unprecedented number of cyberattacks, and the Presidential Office website was briefly taken offline by an overseas attack. The defense and foreign ministries, the state power company and the main airport website were also attacked, and digital signs at a railway station and convenience stores were hacked. Officials found no information security breaches and no government named an attacker.
What happened
Nancy Pelosi, then Speaker of the US House of Representatives, arrived in Taiwan on Tuesday 2 August 2022, despite warnings and threats from Beijing. On the same day the Presidential Office website was temporarily taken offline following an overseas cyber attack, according to Presidential Office spokesperson Xavier Chang. It was back to normal service the same day. Government agencies reported an unprecedented number of cyberattacks, and Internet traffic volume reached 23 times the previous single-day record.
The attacks continued. Executive Yuan spokesman Lo Ping-cheng said, as reported on 5 August, that the Presidential Office, the Ministry of National Defense and the Ministry of Foreign Affairs were still under attack on 3 August, that no information security breaches had been found, and that the purpose of the attacks was to penetrate government networks. Taiwan Power Co said it saw 4.9 million cyberattacks on 3 August alone, more than in June and July combined. The Taoyuan International Airport website was unstable for about three hours on 4 August, while the airport company said its internal network and applications kept working. On 5 August the Ministry of Foreign Affairs said attacks aimed at bringing down its website had doubled over the previous 24 hours.
Separately, digital signs were hacked. The Criminal Investigation Bureau confirmed that the display networks of several convenience store outlets and a Taiwan Railways Administration station had been hacked and showed messages attacking Pelosi. The bureau said the server of the chain stores’ contractor had been hacked, and that the company running the railway’s signboards was hacked at about 10am on 3 August. The railway said its own website and database were not compromised. Sources differ on timing: the Taipei Times reported on 5 August that the boards were hacked before Pelosi arrived, while Focus Taiwan reported on 3 August that the signs were hacked on Wednesday 3 August.
No government source opened names who carried out the attacks. A legislator said it was most likely the work of Chinese hackers, but that was his opinion and not an official attribution.
Timeline
-
2 August 2022
Pelosi arrives in Taiwan. Government agencies report an unprecedented number of cyberattacks and traffic reaches 23 times the previous single-day record.
-
2 August 2022
The Presidential Office website is temporarily taken offline after an overseas cyber attack and returns to normal service the same day.
-
2 August 2022
The Ministry of Foreign Affairs first reports attacks aimed at crashing its website, according to its later statement of 5 August.
-
3 August 2022
The Presidential Office, the Ministry of National Defense and the Ministry of Foreign Affairs keep facing attacks, the Executive Yuan says (reported 5 August).
-
3 August 2022
Taiwan Power Co records 4.9 million cyberattacks in one day, more than in June and July combined.
-
3 August 2022
The Criminal Investigation Bureau confirms that digital signage at convenience stores and a railway station has been hacked to show messages against Pelosi.
-
3 August 2022
A company that runs railway signboards is hacked at about 10am. Railway officials cut the signboard power.
-
4 August 2022
The Taoyuan International Airport website is unstable from 8am and normal again around 11am.
-
5 August 2022
The Ministry of Foreign Affairs says attacks on its website doubled over the previous 24 hours.
-
4 October 2022
The Minister of Digital Development tells the legislature that the government learned from the attacks and proposes regular security health checks.
-
18 October 2022
The Executive Yuan is reported to be drafting rules to tighten limits on China-made telecom hardware and software in government agencies.
How the attack worked
The sources opened describe two kinds of activity. They do not give technical detail such as tools, malware or exploited flaws, and no source opened names the attackers.
Flooding public sites
The Minister of Digital Development said many government agencies and private websites reported distributed denial of service (DDoS) attacks. This kind of attack sends so much traffic that a site cannot answer real visitors. The Presidential Office site went offline for a short time, the airport site was unstable for about three hours, and the Foreign Ministry reported repeated attempts to bring its site down. Lo Ping-cheng said the purpose of the attacks was to penetrate government networks, but also said no breaches were found and that protocols from regular security drills prevented significant damage.
Taking over digital signs
The Criminal Investigation Bureau said the server of the convenience store chain’s contractor had been hacked, and that a company running the Taiwan Railways Administration’s signboards was hacked. In both cases the displays showed messages against Pelosi. The National Communications Commission chairman said the store boards were easily hacked because they use Chinese software. The Taipei Times later reported that a railway station billboard had been rented to a contractor whose China-made operating software was hacked, and that the Executive Yuan took remedial action to patch the vulnerability.
What stopped it spreading
The railway cut the signboard power quickly and said its website and database run on a separate network. The airport company said its internal network and applications kept working. The minister said the government spread data from attacked systems to other computers to counter the attacks.
- Flood public websitesDDoS traffic aimed at government and infrastructure sites, including the Presidential Office, defense and foreign ministries, the power company and the airportTechnique T1498 (MITRE ATT&CK, opens in a new tab)
- Hack sign contractorsThe servers of contractors running convenience store and railway display networks were hacked
- Show political messagesDisplays showed messages attacking Pelosi until power was cutTechnique T1491 (MITRE ATT&CK, opens in a new tab)
- Contain and recoverTraffic was absorbed, signs were switched off, sites came back the same day or within hours
Who says who was behind it
No public attribution in the sources opened. The Presidential Office described the attack on its website as an overseas cyber attack (2 August 2022) but named no state or group. The Executive Yuan, Ministry of Foreign Affairs and Criminal Investigation Bureau statements opened name none either. A legislator said it was most likely the work of Chinese hackers (Taipei Times, 4 August 2022); this is his opinion and not an official attribution. The National Communications Commission chairman said the store boards used Chinese software, which is a statement about the software and not about who attacked.
Impact
Presidential Office website: temporarily offline on 2 August 2022, restored the same day.
Government: the Executive Yuan said no information security breaches were found (3 August 2022). The Presidential Office, Ministry of National Defense and Ministry of Foreign Affairs were attacked for several days.
Power: Taiwan Power Co recorded 4.9 million attacks in one day, more than June and July combined.
Airport: the Taoyuan International Airport website was unstable from 8am to about 11am on 4 August; the internal network kept working.
Signs: digital displays at several convenience stores and a railway station showed messages against Pelosi until switched off.
Figures for the total number of attacks across government are not given in the sources opened, beyond the traffic record of 23 times the previous single-day high.
Government and regulator response
- 2 August 2022: The Presidential Office restored its website the same day.
- 3 to 5 August 2022: The Executive Yuan said it had activated and reinforced preventive mechanisms and that its cybersecurity department had been asked to inspect government sites around the clock.
- 3 August 2022: The Criminal Investigation Bureau confirmed the sign hacks and found the contractor servers had been hacked. Railway officials cut the signboard power.
- 4 October 2022: The Minister of Digital Development told the legislature that departments and system integrators learned from the attacks how to rebuild systems using advanced technologies, and proposed that start-ups and security companies run regular health checks of security mechanisms.
- 18 October 2022: The Taipei Times reported that the Executive Yuan was drafting rules to tighten limits on China-made telecom hardware and software in government agencies and their contracted public sites. The Cyber Security Management Act already bars government agencies from using products harmful to national cyber security unless approved case by case.
Lessons
-
Practice before the event
The Executive Yuan credited protocols from regular security drills for preventing significant damage. Drills turn a plan into a habit.
-
Floods are expected around political events
Attacks arrived on the day of a high-profile visit and kept growing for days. Plan capacity and traffic filtering for dates you can predict.
-
Keep public sites apart from core networks
The railway said its website and database were not compromised because they run on a different network. Separation limits harm.
-
Contractors are part of your attack surface
The sign hacks came through the servers of contractors that ran the display networks. Ask suppliers how they secure systems that show your name in public.
-
Know the origin of your software
The communications regulator chairman pointed to Chinese software on the hacked boards, and the government began drafting stricter rules. Know where the software on public-facing devices comes from.
-
Have a quick off switch
Railway officials cut the signboard power quickly. Make sure staff know how to switch off a display that has been hijacked.
What to check in your own organization
-
DDoS readiness
Check that you have traffic filtering or a content delivery service for public sites, and test it against a large spike.
-
Event calendar
List dates when your organization could become a political target and raise monitoring before them.
-
Signage and kiosks
List every screen, kiosk and sign that shows your content and who manages it. Check that default passwords are gone.
-
Contractor access
Review which contractors can change content or reach your networks, and require them to report incidents quickly.
-
Network separation
Check that public websites and display systems cannot reach internal databases.
-
Software origin
Record the origin and update path of the operating software on public-facing devices.
-
Off switch
Write down who can switch off a hijacked display or site and how fast.
Where it happened
- Industry Government and public sector State-backed espionage, supplier breaches, attacks on exposed servers and targeted phishing against public bodies, and the rules that apply.
- Country Taiwan Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count. Asia Pacific
Questions
When did the attacks begin?
On 2 August 2022, the day Pelosi arrived in Taiwan. The Presidential Office website was taken offline that day, and attacks went on for several days.
Who was behind them?
No government source opened names an attacker. A legislator said it was most likely Chinese hackers, but that is his view and not an official attribution.
Was data stolen?
The Executive Yuan said no information security breaches were found. The sources opened do not report stolen data.
What happened to the digital signs?
The Criminal Investigation Bureau confirmed that displays at several convenience stores and a railway station were hacked to show messages against Pelosi, after contractor systems were hacked.
Which sites were affected by the floods?
The Presidential Office, Ministry of National Defense, Ministry of Foreign Affairs, Taiwan Power Co and the Taoyuan International Airport website were reported as affected.
What changed afterwards?
The government drafted stricter rules on China-made telecom hardware and software in government agencies, and the digital minister proposed regular security health checks.
Sources
- Presidential Office website returns to normal service after cyber attack (2 August 2022) Focus Taiwan (CNA)
- Cyber attacks reported in stores, gov't facilities during Pelosi visit (3 August 2022) Focus Taiwan (CNA)
- PELOSI'S VISIT: Digital displays attacking Pelosi were hacked: CIB (4 August 2022) Taipei Times
- Record number of cyberattacks reported (5 August 2022) Taipei Times
- MOFA reports continued cyberattacks seeking to crash its website (5 August 2022) Focus Taiwan (CNA)
- Xi tested as Chinese nationalists bristle at Pelosi Taiwan visit (5 August 2022) Al Jazeera
- Taiwan training 'red team' to counter hackers (5 October 2022) Taipei Times
- Tighter rules on China devices coming (18 October 2022) Taipei Times
- Cyber Security Management Act Laws and Regulations Database of the Republic of China (Taiwan)
- Network Denial of Service, Technique T1498 - Enterprise MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.