By Hamza Faisal
Taiwan Semiconductor Manufacturing Company, the world's largest contract chipmaker, has confirmed that personal data belonging to some of its current and former employees was exposed through a third-party cloud service provider, after hackers put a claimed trove of staff records up for sale for 3 bitcoin.
TSMC issued its confirmation on Wednesday, November 12, saying the information had been posted on external websites without authorisation. The company stressed there is currently no evidence that its own internal systems or wafer manufacturing equipment were compromised, and that chip production and customer data were unaffected.
The disclosure came after an underground seller claimed to hold around 46,000 TSMC employee records totalling 6.9 gigabytes, offered for sale on forums including DarkForums and BreachForums. The asking price was 3 bitcoin, worth roughly $220,000, or about NT$7.4 million, with a threat to publish the full dataset if no buyer stepped forward within a week.
What the hackers claim to hold
To back up the claim, the sellers released a sample file named "tsmc.txt" containing 499 records, each with 19 fields. Reporting on the sample says it includes employee names, dates of birth, job titles, nationalities, national ID numbers, home addresses, mobile phone numbers, email addresses and bank account details, extending even to emergency contacts' phone numbers and addresses.
Whether all 46,000 records claimed by the seller are genuine remains unverified. TSMC has not confirmed the advertised total, and has not disclosed how many people are actually affected or named the cloud service provider involved.
TSMC points to a cloud provider, not its own systems
TSMC said its preliminary comparison found the leaked content matched data held in the systems of a cloud service provider it works with, rather than resulting from a direct attack on the company's core information systems. The company said the leaked content is unrelated to chip manufacturing operations or customer information.
The chipmaker said it has begun notifying affected employees and is working with the cloud provider, law enforcement agencies and third-party cybersecurity firms to investigate. The identity of the provider and the mechanism used to obtain the data have not been disclosed.
For employees whose national identification or banking details may have been exposed, the incident carries a practical risk beyond embarrassment: the sample reportedly contains enough detail for identity theft and targeted fraud, which is why the one-week deadline matters. If the data goes public, the damage spreads from a single seller to anyone who downloads it.
A familiar weak spot for the chip giant
The incident is not the first time a TSMC supplier has been the way in. In 2023, the LockBit ransomware group targeted TSMC hardware supplier Kinmax Technology in an extortion attempt that demanded $70 million, again reaching the chipmaker through a third party rather than its own network.
The pattern is a reminder that even the world's most important chipmaker, whose factories sit at the centre of the global AI boom, is only as secure as the vendors holding its data. TSMC's own fabs and customer wafer designs were untouched this time, but the employee records sitting in an outside cloud system were not.
The leak is separate from TSMC's operations, which continue to run at full pace. The company reported record October revenue of $17.8 billion earlier in the day, driven by surging demand for AI chips. The investigation into the leak, and the identity of the cloud provider at its centre, is ongoing.
