When a Taiwan-listed company suffers a cyber incident, technical recovery is only part of the job. If the incident causes material damage or impact to the company, it must also publish a material information filing (重大訊息). The disclosure procedures of both the Taiwan Stock Exchange (TWSE) and the Taipei Exchange (TPEx) list "information and communication security events" in Article 4(1)(26)[1][2], and both exchanges explain in their Q&A guides what counts as material[3][4].

This guide is for CISOs, IT heads, spokespersons, finance and legal staff at listed companies, and for foreign managers whose Taiwanese entity is listed or is a significant subsidiary of a listed group. It covers when to file, how fast, what to include, how to update the filing, and what to prepare in advance. Our company filings page collects the original text of these filings, so you can compare real examples.

The rule: Article 4(1)(26) of the disclosure procedures

Article 4(1)(26) of the TWSE Procedures for Verification and Disclosure of Material Information of Companies with Listed Securities (對有價證券上市公司重大訊息之查證暨公開處理程序) covers the "occurrence of a disaster, group protest, strike, environmental pollution, information and communication security event, or any other material event" that results in any of the following: material damage or impact to the company; an order by the authorities to suspend work or business, or revoke a pollution-related permit; fines for a single event totalling NT$1 million or more; or, for listed financial institutions, revocation of a licence or a sanction other than a fine[1].

The TPEx procedures use the same structure in the same subparagraph[2]; emerging-stock (興櫃) companies follow Article 34(1)(21) of the TPEx review rules for emerging stocks[4].

Two related points are easy to miss[1][4]:

  • Subsidiaries: when a significant subsidiary that is not itself listed or registered as an emerging stock experiences any Article 4(1) event, the listed parent must file on its behalf.
  • CISO changes: a change of chief information security officer is itself a material information event (Article 4(1)(8)).

What counts as "material": the Q&A guidance

Article 3 of the procedures requires listed companies to set up internal procedures for handling material information, including how the decision to disclose is assessed, how approval records are kept and how violations are handled[1]. The Q&A guide adds that each company should set qualitative and quantitative materiality criteria for its industry and size, and keep a record of each assessment and filing[3]. For cyber incidents under subparagraph 26, the TWSE guide explains[3]:

  • What to assess: including but not limited to financial loss, damage to goodwill or intellectual property, effects on customer or supplier relationships, loss of competitive advantage, the cost of fixing vulnerabilities and strengthening security, and possible litigation or investigations. The TPEx guide also lists fines or sanctions by regulators[4].
  • When it is material by definition: when the estimated impact, or media coverage of the incident, may affect investors' decisions; when important systems or the official website are attacked or breached so that the company cannot operate or provide services normally; or when personal data or large volumes of internal documents are at risk of leaking. The examples given include intrusion, destruction, tampering, deletion, encryption, theft and denial-of-service (DDoS) attacks.

Two points deserve attention. First, the test is that data is "at risk of leaking"; a confirmed leak is not required. Second, the TPEx guide suggests that if the damage or impact is uncertain and its effect on investors cannot be assessed, the company may file under this subparagraph to reduce information asymmetry[4].

Deadlines: before the next trading day opens, or 2 hours after media reports

The TWSE procedures set these deadlines[1]:

  • Normal case: file two hours before trading begins on the trading day after the date of the event; if a press release is issued earlier, file at the same time (Article 6(1)(1)).
  • Media reports first: if the company finds media reports of an Article 4(1) event, or reports that could move the share price or are inaccurate, it must file an explanation immediately and no later than two hours after discovery (Article 6(1)(2)).
  • Exchange inquiries: if the TWSE asks before 5 pm on a trading day, the company must respond within two hours; if after 5 pm or on a holiday, two hours before trading begins on the next trading day (Article 9).

TPEx follows the same principle; its briefing material states the normal deadline as two hours before the next trading day's open (7:00 am) and two hours after discovery for media reports[2]. The Q&A guide also recommends that filings not responding to media reports be published as soon as possible outside trading hours, so that investors receive them at the same time[3].

On language, TWSE requires filings to be entered in both Chinese and English (Article 6(3))[1]. Since 1 April 2025, TPEx has required English filings as well from companies that meet certain criteria, such as paid-in capital of NT$600 million or more in the latest fiscal year, or combined foreign and mainland Chinese shareholding of 30% or more[2].

A large loss can also require a material information press conference: when a cyber incident or similar event causes material damage and the estimated loss, after deducting expected insurance recovery, exceeds 20% of paid-in capital or reaches NT$300 million (Article 11(1)(9))[1]. Such events must be filed on the day of the event or the media report, and no later than two hours after the press conference (Article 6(1)(3))[1].

What to include: required content and common gaps

Article 3 requires a filing to describe the facts, the cause, the effect on the company's finances and operations, the estimated financial impact and the response, using the exchange's filing format. Statements to the public and media must match the filing and must not be biased, boastful or promotional, or include unconfirmed or inaccurate information[1]. The same article prohibits releasing any information before it has been disclosed under the procedures[1].

The Q&A guide adds several common issues[3]:

  • Every field should be completed with specific information rather than marked "not applicable".
  • Possible insurance recovery is no reason to leave out the potential loss or its effect on the business.
  • The text should be easy to understand, with technical terms explained in plain language.
  • A follow-up filing on an ongoing matter should state the date of the earlier filing.

On that basis, a cyber incident filing should at least let investors understand when the incident was discovered, which systems or services are affected, whether operations are disrupted and how recovery is progressing, whether personal or customer data is involved, what has been done (for example isolating systems, engaging outside experts or reporting to the police), and the estimated financial impact. If the impact cannot yet be estimated, say why and how you will update it. You can compare how different companies word their filings on our company filings page.

Follow-up filings: update when things change materially

Under Article 3, if a disclosed matter develops materially, the company must promptly update or supplement the filing under the same subparagraph[1]. The Q&A guide gives the example of later discovering that personal data or large volumes of internal data were stolen, or are circulating or offered for sale on the dark web[3]. If media reports conflict with what the company has disclosed, it should promptly clarify on the Market Observation Post System (MOPS, 公開資訊觀測站)[3].

A filing does not replace other legal obligations:

  • If the company is also a specific non-government agency under the Cyber Security Management Act (for example, a designated critical infrastructure provider), it must still report incidents to its sector authority[5]; see Taiwan's Cyber Security Management Act for the deadlines.
  • Personal data breaches also trigger duties under the Personal Data Protection Act. Amendments promulgated on 11 November 2025 require notifying data subjects and, within a defined scope, reporting to the regulator, but their effective date is still to be set by the Executive Yuan; as of the end of October 2026 the Laws & Regulations Database still marked some provisions as not yet in force. The provision currently in force requires notifying data subjects by appropriate means, after investigation, when a violation leads to personal data being stolen or leaked[6].

Governance: CISO and a dedicated security unit

Article 9-1 of the Regulations Governing Establishment of Internal Control Systems by Public Companies (公開發行公司建立內部控制制度處理準則) requires public companies to allocate adequate staff and equipment to information security, and allows the Financial Supervisory Commission (FSC) to order companies that meet certain conditions to appoint a CISO and set up a dedicated security unit with a head and staff[7]. The FSC's Q&A sets out the scope and timetable[8]:

  • Listed companies meeting any of these conditions: paid-in capital of NT$10 billion or more; a constituent of the Taiwan 50 Index at the end of the previous year; or online and other electronic revenue of at least 80% of operating revenue in the latest year, or at least 50% over the latest two years combined. These companies had to appoint a CISO and set up a dedicated unit with a head and at least two staff by the end of 2022.
  • Other listed companies with no consecutive pre-tax losses over the last three years and net worth per share not below par value had to appoint a dedicated security head and at least one staff member by the end of 2023.
  • Companies that meet the conditions later (from 2023 for the first group, from 2024 for the second) must adjust their staffing within six months.

The Q&A also notes that the CISO role should be held by the person who oversees security policy and resources, typically a senior executive such as a vice president[8].

The Cybersecurity Control Guidelines for Listed and OTC Companies (上市上櫃公司資通安全管控指引), issued by TWSE and TPEx, provide a management framework: a dedicated security head and staff, incident response and reporting procedures, regular reporting to the board or management, and handling of major incidents that meet the disclosure rules in accordance with those rules. The guidelines also list what the annual report should describe, including security policy, management programmes, resources invested, and the losses, possible impact and response for major incidents[9]. Unless laws or exchange rules provide otherwise, companies may apply the guidelines in a way suited to their industry, size and risk[9].

Action checklist

  1. Write the disclosure decision flow: who decides (CISO, spokesperson, finance, legal), which qualitative and quantitative thresholds apply, and how the assessment is recorded. Make "important systems or website unable to operate", "personal data or large volumes of internal documents at risk of leaking" and "media has reported it" direct triggers for the filing process.
  2. Put the deadlines into your incident response plan: two hours before the next trading day's open, two hours after media reports, the exchange inquiry deadlines, and who files at night and on holidays.
  3. Prepare Chinese and English templates covering facts, cause, scope, financial impact (or why it cannot yet be estimated), response and how you will update, so only the details need filling in.
  4. Keep one public message: say nothing externally before the filing, and file at the same time as any press release.
  5. Include subsidiaries: require significant subsidiaries and overseas sites to notify the parent immediately so it can file on their behalf.
  6. Define follow-up triggers: confirmed data theft, data appearing on the dark web, restoration of operations, revised financial impact.
  7. Map parallel obligations: Cyber Security Management Act reporting, personal data rules and sector regulators, so that each channel tells the same story.
  8. Learn from real cases: review peers' filings on our company filings page and the time from event to disclosure in our Taiwan disclosure report; related incidents are listed under data breach.

This is a general overview, not legal advice; check the current TWSE, TPEx and FSC rules, Q&A guides and official interpretations before acting.