TSMC data leak: employee data exposed in third-party cloud incident

TSMC confirmed on Thursday, November 12, that personal data of current and former employees was published without authorization on an external website. The TSMC data leak was disclosed by the world's largest contract chipmaker in a Form 6-K filed with the U.S. Securities and Exchange Commission (SEC), signed by CFO Wendell Huang.

According to the company, a preliminary review found that the exposed information matches data stored in the systems of a cloud service provider TSMC works with. The company says there is currently no evidence that its own IT systems or wafer fabrication equipment were compromised — and that production and customer data were not affected.

What TSMC confirmed

  • Personal data of some current and former employees was published without authorization on an external website.
  • The information matches records held by a third-party cloud service provider.
  • There is no evidence so far that TSMC's internal systems or manufacturing equipment were compromised.
  • The exposure does not involve chip production operations or customer data, according to the company.
  • TSMC says it is notifying affected employees and providing support, and working with the provider, authorities and a third-party cybersecurity firm on the investigation.

What the sellers claim — and what has not been confirmed

On underground forums such as DarkForums and BreachForums, anonymous sellers claim to hold around 46,000 TSMC employee records, in a dataset of about 6.9 GB, offered for 3 bitcoin — roughly US$220,000, or NT$7.4 million. According to Taiwanese media, including United Daily News and the Central News Agency (CNA), the sellers have threatened to publish the full dataset if no buyer comes forward within a week. The listing reportedly first appeared on November 8, according to The Record.

To back up the offer, the sellers released a sample file called "tsmc.txt", with 499 records and 19 fields each — reportedly including names, birth dates, job titles, national ID numbers, addresses, phone numbers, email addresses, bank details and emergency contacts.

It is important to separate fact from claim: TSMC has not confirmed the 46,000-record figure, the 6.9 GB size or the asking price. The company also has not disclosed how many people were affected, which categories of data were involved, or the name of the cloud provider. There is no public evidence that a buyer has come forward, that a transaction took place, or that the threatened full release has happened. On X, the story spread widely: a post by Andrew Curran with an image of TSMC's Form 6-K filing had nearly 600,000 views on November 13.

What is still unknown

  • Which cloud provider held the records and which service was involved.
  • How the data reached the external website — whether by intrusion, accidental exposure or another mechanism.
  • How many people were affected and whether the released sample is authentic and complete.
  • Whether the sellers will follow through on the threat to publish the full dataset.

Context: a recurring target

TSMC makes chips for the world's biggest technology companies and sits at the center of the global semiconductor supply chain — which makes it a constant target. In June 2023, the LockBit ransomware group listed TSMC as a victim and demanded US$70 million, but the actual breach had hit hardware supplier Kinmax and involved only test-environment configuration files. The current episode follows a similar pattern: the weak point was not the factory, but an external link in the supply chain.

Featured image: TSMC Fab 14B in Tainan, Taiwan, photographed in May 2025 by 4300streetcar, via Wikimedia Commons (CC BY-SA 4.0 license).

Sources

Transparency: this article was produced with the assistance of artificial intelligence, based on cross-checking public posts on X and sources from the internet. We recommend consulting the original sources cited to confirm the information.

By Muse