TSMC has confirmed that personal data belonging to some of its employees was exposed through a third-party cloud system. The company says its own internal systems were not breached, and that production operations and customer data were unaffected.
The disclosure came on November 12. It is the kind of incident that gets attention mostly because of who TSMC is: the largest contract chipmaker in the world, and a supplier to nearly every major name in computing.
What the hackers say they hold
The group claims to have about 46,000 employee records, roughly 6.9 GB of data, covering both current and former staff. The records were listed for sale on DarkForums and BreachForums at a starting price of 3 BTC, about $220,000 when the listing went up.
The sellers also set a deadline. If no buyer comes forward within a week, they say they will publish the full dataset. To show they are not bluffing, they released a sample file named “tsmc.txt” with 499 records, each holding 19 fields.
Those fields reportedly include names, national IDs, home addresses, phone numbers, email addresses, bank information, job titles and emergency contacts. That is enough detail for identity theft, and perhaps for targeted phishing against staff.
TSMC’s response
TSMC’s position is that the leak started with an outside cloud provider. It says no internal system was compromised. The company is notifying the people whose information was exposed and is working with the cloud vendor, law enforcement and outside security firms to contain the fallout.
This is not the first ransom demand tied to TSMC. In mid-2023, the LockBit group targeted the company in an extortion attempt that centered on a hardware supplier rather than TSMC’s own operations. That episode caused no major operational damage. The pattern, though, rhymes: in both cases the attackers came in through a partner, not the front door.
Why the vendor angle keeps returning
Large companies have spent years hardening their own networks. Attackers have responded by going after the smaller firms that hold a big company’s data on its behalf.
The TSMC case fits that template. The crown jewels look intact, yet workforce personal data traveled through an external system and ended up for sale on a forum.
What to watch
On the operational side, the headline facts are reassuring. TSMC says production and customer data were not touched, which is the part of the business that drives revenue and client trust.
One detail worth noting: Bitcoin transactions sit on a public ledger. Any payment to the sellers would leave a visible trail, which is part of why law enforcement involvement matters in cases like this.
There are three things to track from here. First, whether the hackers follow through on publishing the full dataset once the week runs out. Second, whether TSMC or the cloud vendor says more about how the data was accessed. Third, whether regulators in Taiwan or elsewhere take an interest in the vendor’s security controls.
