TSMC Confirms Employee Data Breach as Hacker's Deadline Arrives

TSMC has confirmed that personal data of some current and former employees was posted on an outside website without authorization, just as a hacker's November 15 deadline to leak the files for free arrives. The world's largest contract chipmaker, which builds processors for Apple and Nvidia, says the records came from a cloud service provider's systems and that it found no sign its own network was breached.

The disclosure came in a Form 6-K, the short report foreign companies listed in the US use to flag important events, filed on November 12. In TSMC's SEC filing, signed by CFO Wendell Huang, the company says the data is "unrelated to the company's operations or customer-related data."

What did TSMC say about the data breach?

"TSMC has found that some of our current and former employee data was made available on an external website without authorization," the statement reads. It adds, "Currently, we have found no evidence that TSMC's systems have been compromised."

According to the filing, the leaked information matches data stored in the system services of a cloud service provider, a third party that hosts or processes data for customers. TSMC says it is informing affected staff, providing support and working with the cloud vendor, investigating authorities and an outside cybersecurity firm to establish the facts. It has not named the provider, explained how the data was taken or said how many people are affected.

What does the hacker claim to have?

The TSMC data breach surfaced on November 8, when a user calling themselves "SmithBianl" posted a 499-row text file on a hacker forum, BleepingComputer reported. The seller described it as a sample of a 6.9GB dataset holding 46,000 employee records, figures that have not been independently verified.

According to the post, the files include national ID numbers, home addresses, contact details and banking information. A screenshot of the listing also mentions dates of birth, job titles, mobile numbers, email addresses, bank codes and two emergency contacts per employee.

The seller opened bidding at 3 BTC and threatened to publish everything for free within a week if no buyer appeared. Reports disagree on the dollar value, with BleepingComputer putting it near $65,000 and The Record at about $200,000, and a TSMC spokesperson declined to say whether the company had contacted the seller or would pay.

Why does a leak at a cloud vendor matter?

The incident shows how a supplier can expose a company's people even when the company's own systems are clean. For the employees involved, the bigger risk is not the auction itself but what follows: phishing calls, messages and bank scams that sound convincing because they quote real ID numbers, addresses and family contacts.

Anyone affected should watch bank accounts closely, treat unexpected calls or texts that cite personal details with suspicion and follow TSMC's own notices. Our guide on how to know if your phone is hacked covers the warning signs that often follow this kind of leak.

Has TSMC been hit through third parties before?

Yes. In June 2023 the LockBit ransomware gang listed TSMC as a victim and demanded $70 million, and TSMC said the leaked server setup files came from IT hardware supplier Kinmax Technology, not its own systems, according to TechCrunch. TSMC cut off data exchange with that supplier and said operations and customer data were unaffected.

A more damaging case came in August 2018, when a WannaCry variant spread through fab tools in Taiwan after a new machine was connected without being scanned. TSMC first estimated a hit of about 3% to third quarter revenue, later trimming that to about 2%.

Third parties are a recurring weak spot across tech this month, from the Railway hack that stole AI keys from up to 100,000 workspaces to this week's TSMC filing. The leak lands the same week TSMC announced a $500 million venture fund for chip startups, a reminder that its suppliers and partners are becoming a bigger part of its security picture.

TSMC incident at a glance