Donation scam emails: confirmed, suspected and impersonated at five Taiwanese charities

Between October and early November 2026, two Taiwanese charities confirmed that donor data had been accessed or leaked: Boyo Social Welfare Foundation (博幼) and the Zhi-Shan Foundation (至善基金會; name translated here). The Garden of Hope Foundation (勵馨) announced suspected improper access to donor data. The Apple Charity Foundation (蘋果慈善基金會; name translated here) and the Sunshine Social Welfare Foundation (陽光) announced emails or text messages in their name about duplicate deductions, changed donations or refunds; Sunshine’s quoted donors’ names, phone numbers and donation amounts. If the signature is a foundation the recipient has given to, the email has a head start.

The table below sets out what each has said: confirmed, suspected or impersonated. One such email does not show which foundation’s donor list, if any, has leaked. Sources were checked to 15:40 Taipei time on 6 November 2026, with the foundations’ own websites as authoritative.

What each foundation has published

Foundation	Nature, per the announcement	Surfaced and announced	Online donations (6 Nov)	Not yet disclosed
Boyo	Confirmed intrusion into an outsourced, vendor-hosted system; some donor data accessed	Impersonating emails from 10 October; emergency notice 10 October, update 13 October	Suspended in October; no notice of resumption on the website	Vendor, vulnerability, full list of accessed fields, head count, intrusion period
Zhi-Shan	Confirmed personal data leak, some data unlawfully obtained; preliminary investigation suggests an intrusion during testing of a new system; no leak of bank account or card data found	Notice of 5 November on suspected impersonation asking sponsors to reset recurring donations; incident statement 6 November	Not checked	Vendor, types of data, head count, intrusion period
Garden of Hope	Suspected improper access to donor data; scope under investigation; anti-fraud reminders issued	Noticed in an internal security review, date not given; notice 4 November	Donation page shows online giving, cards included, suspended; no date given	Who is affected, fields, whether police were notified
Apple Charity Foundation	Website and email impersonated; data leak not mentioned	Reports received 12 October; several notices since, full explanation 3 November	No suspension announced	Whether any data leaked
Sunshine	Impersonating emails and texts quoting donor names, phone numbers and amounts; source of the data not stated	Reports received, date not given; notice 3 November, updated 4 November	No suspension announced	Where the data came from, whether any system was breached, how many donors

Boyo’s update of 13 October says a review with external security experts and the system vendor confirmed an intrusion into its outsourced, vendor-hosted system and access to some donor data. It lists isolating the system, preserving evidence, suspending online donations on the website and suspending settlement of card donations made from 9 October and October’s recurring debits through every channel, and reports more than 80,000 warning SMS messages sent; the number of donors affected is not given. The update gives 10 October for the police report and 11 October for notifying the competent authority, while the emergency notice puts both on 11 October; this article leaves the discrepancy as it is. The intrusion date has not been published.

The Zhi-Shan Foundation’s notice of 5 November says it had reports of someone apparently using its name to contact sponsors and ask them to reset recurring donations. Its personal data security statement of 6 November says it recently found a personal data leak and that a preliminary investigation suggests outsiders broke in while a new system was being tested, unlawfully obtaining some data. It has stopped the testing, isolated the donor database, reported to the police and notified donors by email and SMS. It says no leak of bank account or credit card data has been found, and that it is still checking. The contractor is referred to only as its “system partner”; neither the number of donors nor the types of data have been published, and neither notice links the impersonation to the leak.

Garden of Hope’s notice of 4 November calls the access suspected, says it is investigating which donors and data may be affected, and mentions neither outsourcing nor any email received. The notice says nothing about suspending donations, but when checked for this article its donation page said online giving, cards included, was temporarily unavailable. The Apple Charity Foundation’s explanation of 3 November says reports arrived on 12 October of emails impersonating its website and email address with donation-change notices; it reported the same day to the Ministry of Digital Affairs (moda) and to Taiwan’s 165 anti-fraud hotline, run by the National Police Agency, and the fake URL came down on 13 October. Its site keeps no card numbers for online donations, which sit at the acquiring bank, and it has filed a report with the police. The 15 October version did not carry those two points; the 23 October version did. A reminder was still running on 6 November, and the foundation still describes the case as impersonation.

The Sunshine Social Welfare Foundation’s statement of 3 November says emails and text messages in its name carried donors’ names, phone numbers and donation amounts, and that it has stepped up protection and is cooperating with the authorities. It does not say where the data came from or mention any intrusion. Messages that quote donor details give more reason to trace the source than plain impersonation does, but the statement goes no further.

The five came within weeks of each other; none says the incidents are related or share a source.

Where donor data normally travels

These are general data flows, not findings about any of the five cases.

Where a card number is stored depends on each organisation’s setup. An article by the Taiwan NPO Self-Regulation Alliance (台灣公益團體自律聯盟, a membership body for non-profits; name translated here) lists the points a donation passes through as the online entry point, the CRM or donation management system, internal work in Excel, the payment provider and the banks, with the card number encrypted and passed to the payment provider, not stored on the website, and only the charge result and last four digits kept. Beyond that article, and as a general note: paper authorisation forms have their own intake and filing, and a mailing platform, support records and backups may also hold copies. Once a file is exported, the main system’s logs usually cannot show what happened to it.

Naming any of these as a source needs matching evidence. Boyo describes an outsourced, vendor-hosted system and Zhi-Shan a new system under test with a system partner; neither names the vendor or publishes access records or an intrusion date. Sunshine’s messages carried donor data, but it has not said from where. Boyo’s notices also mention scammers reaching donors by email and through unofficial LINE accounts (LINE is Taiwan’s main messaging app). Whether an email’s sender name was forged or a real mailbox was logged into takes mail headers, login records and outbound logs to tell, and none of the notices includes them. One email cannot show whether the sender had a precise donor list or got lucky; that takes send volume, hit rate and fields public data could not supply.

A shared vendor can affect many organisations at once, and 2021 is the precedent. Zhi-Shan’s statement that year traced the incident to a data leak at its database vendor, later updated to say the vendor’s system had been hacked and dozens of charities hit together. That was a separate incident five years ago; this article does not connect it to any 2026 case, Zhi-Shan’s own included.

What to do, by how far it went

A correct amount or card suffix in the email does not mean card data has leaked. The last four digits are not the full card number, expiry date, CVV or an online-banking password; none of the five foundations lists them among the data accessed, and Zhi-Shan says it has found no leak of financial data. Receiving an email does not by itself show that card data was stolen. Boyo, however, advises anyone who has donated to it by card to watch for unusual charges or ask the issuing bank to cancel and reissue the card; whether to cancel is a call the issuing bank can help with.

Contact details come from the official website, never from the phone number, link or LINE account in the email: Boyo’s notice gives 049-2915055, Zhi-Shan’s 02-2388-9118, Garden of Hope’s 02-8911-8595, Sunshine’s 02-2507-8006 (all Taiwan domestic numbers), and the Apple Charity Foundation refers to its website.

Only received the email: do not click or reply; keep the original with the sender address and timestamp. Receiving it is not evidence of infection.

Clicked the link: do not reopen the page. Check whether anything was downloaded, run or installed; leave unopened files alone and scan anything run or installed with trusted security software, with help if needed.

Entered a password: change it at once, and wherever it is reused. Turn on two-factor authentication where available, starting with the email account.

Handed over card details (full card number, security code or SMS one-time code): contact the issuing bank immediately. Handed over online-banking credentials or a transaction OTP: contact the bank holding that account. In both cases dial 165. Do not follow instructions to use an ATM to cancel a donation deduction or instalment plan; all five foundations say they never ask donors to use an ATM or online banking.

Already transferred money: keep the transfer record, the conversation and the original email; contact the bank and 165 immediately and file a police report. Recovery is for the bank and the police, with no guarantee.

What a charity can do now

Charities can start with an inventory of the systems donor data passes through, their outsourcing contracts and the accounts that can log in. Article 8 of the Enforcement Rules of Taiwan’s Personal Data Protection Act (PDPA) requires the commissioning organisation to supervise its contractor, check periodically and record the checks. They can also keep only what the law requires, open accounts only to those doing the work, put multi-factor authentication on remote logins and log reads of the donor list.

A donor notification should state who is affected, whether the incident is suspected or confirmed, and the verification number printed on the official website. Article 12 of the PDPA as currently in force requires an organisation whose violation of the Act leads to personal data being stolen, leaked or otherwise compromised to notify the data subjects by appropriate means after investigation. The 2025 amendment, promulgated on 11 November 2025, changes the notification and reporting duties; its commencement is left to the Executive Yuan, and the national law database still listed it as not yet set at the check date.

What remains unanswered

The items under “Not yet disclosed” in the table, which system, fields and period were involved, what the access logs and forensics confirmed, and who was notified, wait on the foundations, the contractors or the investigators. When this article was checked, the public pages readable from the 165 hotline, the National Police Agency, the Criminal Investigation Bureau, moda, the Ministry of Health and Welfare and the Personal Data Protection Commission Preparatory Office showed no investigation findings, cross-case statement or named vendor for these incidents. That does not mean nothing has been reported or investigated.

Notes

Confirmed: Boyo (intrusion into an outsourced, vendor-hosted system) and Zhi-Shan (personal data leak; preliminary investigation suggests an intrusion during new-system testing; no financial data leak found). Suspected: Garden of Hope. Impersonated: Apple Charity Foundation, and Sunshine, whose messages quoted donor data from an unstated source. None says they are related.
Neither Boyo nor Zhi-Shan names a vendor, and this article does not either; the 2021 Zhi-Shan case is precedent for shared-vendor risk only and is not linked to any 2026 case.
The data-flow section is general, not a finding about any case.
An email alone does not show card data was stolen; the issuing bank can help decide on cancelling, and Boyo advises its card donors to consider it. Card details go to the issuing bank, online-banking details to the bank holding the account, both to 165.
Current Article 12 of the PDPA requires notification after investigation where a violation of the Act compromises personal data; the 2025 amendment’s commencement had not been set at the check date.