Taiwan Investigates NT$20 Million Embassy Software Contracts Over Suspected Chinese Code

Searches Follow Discovery of Chinese Company Signatures

Taiwanese prosecutors directed searches at 10 locations on October 12, 2026, in an investigation into information asset management software installed at several overseas diplomatic missions. The case concerns government contracts worth more than NT$20 million awarded between 2023 and 2025, and allegations that software containing Chinese source code was repackaged in Taiwan before being supplied to the Ministry of Foreign Affairs.

Four people were brought in for questioning as suspects: the head of Anhe Technology, surnamed Lu; the head of Kunyou Technology, surnamed Chiang; a Kunyou sales representative, surnamed Chan; and the head of Yiwei Technology, surnamed Wu. Investigators also summoned several witnesses. The searches covered company offices and residences associated with the suspects.

The ministry's account identifies a specific technical finding behind the investigation. During a December 2025 security inspection, some files in the software were found to contain signatures belonging to China's Guangzhou Yixin Technology Co. The ministry subsequently referred the matter to investigators and provided the relevant programs for examination.

The ministry says the software was installed on internet connected computers at overseas missions for asset management and did not involve sensitive information. It also says a review of connection records covering the preceding year found no abnormal connection activity at the ministry or its overseas offices.

Those statements distinguish the suspected procurement misconduct from a confirmed security breach. Investigators are examining how the software was developed, represented and supplied. The public accounts do not establish that this software stole diplomatic information, and the discovery of a Chinese company's signatures does not, by itself, prove malicious activity.

How Three Companies Allegedly Supplied the Software

The investigation centers on IP-guard, described as an endpoint security and file encryption system. An endpoint is an individual computer or other device connected to an organization's network. Software of this kind can help manage computer activity and protect files, making its origin and actual capabilities relevant to a security review.

Investigators suspect that Lu, the head of Anhe Technology, previously worked with Guangzhou Yixin Technology to develop IP-guard and that the source code came from China. Source code is the set of instructions used to build a program. Its origin is a different issue from the location of the company that sells or maintains the finished product.

Anhe allegedly repackaged the software in Taiwan, while Kunyou submitted bids in its own name and obtained the ministry's information asset management contracts for 2023 through 2025. Yiwei allegedly helped modify the user interface and provided maintenance services. These are allegations under investigation, not findings of guilt.

The suspected division of work places three separate activities under scrutiny: the origin of the software, its presentation in a government tender, and the modifications and support delivered after procurement. A changed interface affects what users see, but does not by itself establish where the underlying program was developed.

Anhe is described as providing endpoint security and document encryption services, with more than 10 years of project implementation experience. That business description helps explain its role in the supply chain, but does not establish whether the ministry's purchases complied with procurement requirements.

What the Ministry Found During Its Inspection

The ministry says the discovery occurred when an interagency cybersecurity inspection team visited overseas missions in December 2025. During that inspection, the ministry identified unusual files in the asset management software, and analysis found signatures associated with Guangzhou Yixin Technology.

A software signature can help identify the company associated with a file. It is not the same thing as a full examination of the program's source code or every function it performs. The distinction matters here: investigative accounts describe suspected Chinese source code, while the ministry's stated finding is that some files contained a Chinese company's signatures.

The ministry says it notified its supervisory authorities and the authorities responsible for cybersecurity after the discovery. It also supplied the relevant programs to the New Taipei City Field Office of the Ministry of Justice Investigation Bureau and other investigative bodies.

The purchase was made through a government common supply contract, according to the ministry. Such an arrangement allows agencies to buy through an established procurement framework. Its use identifies the purchasing route, but does not settle whether a vendor accurately described the software supplied.

From the Contracts to the October Searches

The sequence spans several years, beginning with the contracts and continuing through the security inspection and criminal investigation. The December inspection date refers to 2025, the year before the October 2026 searches.

• 2023 to 2025: The companies allegedly obtained ministry software contracts with a combined value exceeding NT$20 million.
• December 2025: A security inspection at overseas missions identified software files bearing Guangzhou Yixin Technology signatures.
• After the discovery: The ministry notified the relevant authorities, reviewed connection records and referred the programs for investigation.
• October 12, 2026: Prosecutors directed searches at 10 locations and questioning of four suspects, with several witnesses also summoned.
• That evening: The suspects were being transferred to prosecutors for further questioning.

The Taipei District Prosecutors Office is directing the investigation, with the Investigation Bureau's New Taipei City Field Office conducting investigative work. The ministry initially reported the irregularities to that field office, which sought prosecutorial direction.

The suspected offenses include violations of the Government Procurement Act, fraud and document forgery under the Criminal Code. These investigative grounds extend beyond the technical question of where the software originated. They concern whether the bidding and contracting process involved unlawful representations or documents.

The reported questioning does not establish that anyone has been charged or convicted. No subsequent prosecutorial decision, detention outcome or court finding is identified in the accounts of the searches. They also give no date for a hearing or the release of a completed technical examination.

What the Connection Review Does and Does Not Establish

The ministry's strongest public reassurance is that it checked a year's worth of connection records and found no abnormal connection behavior. It also says the asset management software did not involve sensitive information and was installed on computers used for internet access at overseas missions.

These statements narrow the reported exposure, but they do not answer every question about the software. A review of connection logs addresses recorded network activity. It is not necessarily a complete assessment of the program's permissions, local access to files, configuration or behavior throughout the entire contract period.

The dates are also relevant. The procurement period ran from 2023 through 2025, while the ministry describes examining connection records for approximately one year. The public account does not specify the exact dates covered by that review or establish that it covered every deployment throughout the three years.

No exact number of affected missions or computers has been disclosed in these accounts. There is also no stated finding that the software contained a backdoor, transmitted information to China or was used to obtain diplomatic secrets. Those possibilities should not be presented as established events.

Lawmakers Seek a Wider Examination

Kuomintang legislator Huang Chien-pin called for scrutiny of the ministry's procurement screening and internal security inspections. He questioned how software suspected of containing Chinese code could enter the ministry's systems and remain deployed across the contract period before the issue was detected.

Huang requested an examination of whether the software had remote monitoring, data access or transmission functions, and whether sensitive information had been stolen or disclosed. He also called on the ministry to publish the findings, the extent of any exposure and the corrective measures taken.

Those requests concern capabilities as well as observed behavior. A program may have functions that were not used, were disabled or were restricted by its configuration. Determining what it could do is a separate task from determining what it actually did on the affected computers.

Kuomintang legislator Niu Hsu-ting also called for accountability, legal compensation and changes to later tender reviews. He said the ministry had spent more than NT$100 million building an international internal network to protect important confidential documents, yet continued to face security controversies.

The two amounts concern different purposes. The more than NT$20 million at issue in this investigation relates to asset management software contracts. Niu's figure of more than NT$100 million concerns a broader internal network. They cannot be treated as a single project budget or used to calculate the disputed software's share of that spending.

A Separate Document Leak Adds Pressure

The software investigation comes amid another controversy involving diplomatic documents offered for sale on the dark web. A Control Yuan investigation report is described as identifying 13 leaked Ministry of Foreign Affairs documents. Niu cited that incident when arguing that the ministry needed to resolve recurring security problems.

The document leak and the software inquiry must remain distinct. No connection between the 13 leaked documents and IP-guard is established in the accounts of this case. The ministry's statement that the asset management installation did not involve sensitive information also differs from the subject of the separate document leak.

Together, the controversies explain the pressure for a fuller public accounting, but they do not demonstrate a common cause. Establishing whether either incident resulted from software behavior, access controls, procurement decisions or another failure requires evidence specific to that incident.

The ministry says it will cooperate with the investigation and hold vendors accountable under their contracts if unlawful conduct is confirmed. That position makes contractual action conditional on the findings, rather than announcing that a breach of contract has already been established.

What Still Needs to Be Resolved

The central unresolved issues are what vendors represented during procurement, what software was actually delivered and whether its origin or functions violated the relevant requirements. The public accounts identify the suspected offenses but do not reproduce the tender conditions, vendor declarations or particular documents alleged to be false.

There is also a naming discrepancy in the accounts. Investigative descriptions identify the bidding company as Kunyou Technology using the Chinese name 坤侑科技, while the ministry's procurement account gives 坤佑科技. Both appear in descriptions of the supplier, but the spelling difference should be checked against the actual contract rather than treated as proof of two separate companies.

The reported combined contract value is more than NT$20 million, not a precise published total. The accounts do not provide individual award amounts, deployment dates for each mission or a list of the overseas offices involved. They also do not specify whether the software has since been removed, replaced or restricted.

The next consequential findings would be the technical assessment of the programs and the prosecutors' decisions on the suspected procurement offenses. No publication deadline or next hearing date has been given. Until those findings are established, the case is best understood as a criminal procurement investigation prompted by a confirmed software provenance concern, without a publicly demonstrated data breach attributable to the program.

Key Points

• Prosecutors directed searches at 10 locations and questioning of four suspects on October 12, 2026.
• The investigation concerns software contracts worth more than NT$20 million awarded between 2023 and 2025.
• The ministry confirmed that some software files contained Guangzhou Yixin Technology signatures.
• Investigators suspect Chinese source code was repackaged through a supply arrangement involving three Taiwanese companies.
• The ministry says a review of one year's connection records found no abnormal activity and that the installation did not involve sensitive information.
• Procurement violations, fraud and document forgery are under investigation; guilt and a software related data breach have not been established.
• A separate finding involving 13 leaked diplomatic documents has not been linked to this software case.