TSMC confirms employee data leak
The disclosure
According to the filing, TSMC became aware that certain data relating to current and former employees had appeared on an external website without authorisation. The company stated that it is notifying the affected employees in phases and providing them with support. TSMC is working with the third-party cloud service provider involved, the investigating authorities and an independent cybersecurity agency.
The company was explicit about the scope of the incident. In its own words, there is "no evidence that TSMC's systems have been compromised". The data in question matches records held by a third-party cloud service provider, and the incident is unrelated to the company's operations and production and to customer data. TSMC stated that the incident has no impact on its operations.
What the filing does not establish
The filing does not name the cloud service provider, and it does not state how the data was obtained or placed on the external website. The company has not disclosed how many employees are affected, and it has not published a list of the data fields involved. Those details remain unconfirmed by TSMC, and any account of them rests on other sources rather than on the company.
Claims attributed to the actors
Separate from the company disclosure, the actors behind the publication claim to hold approximately 46,000 records, amounting to 6.9 gigabytes of data. According to reports of their listing, they are asking for 3 Bitcoin, approximately 220,000 United States dollars at current prices, and have threatened to publish the full dataset within a week if it is not sold. These figures are claims made by the actors and have not been verified by TSMC or by any independent authority.
The field list circulating in reports, including names, national identification numbers, addresses, telephone numbers, email addresses, bank details, job titles and emergency contacts, comes from a sample released by the actors as reported by the outlets covering the incident. It is not a list published or confirmed by TSMC, and it should be treated as an unverified claim about the contents of the dataset rather than as an established fact.
The asking price should also be understood for what it is. The listing is a sale offer with a threat to publish the data if it remains unsold. It is not a ransom demand made to TSMC, and it should not be described as one.
Background: the 2023 third-party incident
This is not the first time TSMC has dealt with a security incident involving a third party. In 2023, the company confirmed that data belonging to one of its hardware suppliers, Kinmax Technology, had been affected in an incident linked to the LockBit ransomware group, which demanded 70 million United States dollars. TSMC stated at the time that its own systems were not affected and that production and customer data were unaffected. That episode is relevant background because it illustrates the same pattern seen in the current disclosure: exposure through a supplier or service provider rather than through the company's own systems. The two incidents are distinct, and no connection between them has been established.
Why it matters
TSMC is the largest contract chipmaker in the world, and it manufactures advanced semiconductors for many of the largest technology companies. An incident involving the company therefore attracts attention even when its scope is limited to employee data. The disclosure is significant for three reasons.
First, it concerns personal data rather than industrial data. Employee records, including identification numbers and bank details where such fields are present, carry a direct risk of identity theft and fraud for the individuals involved. That risk exists regardless of whether production or customer data was affected.
Second, the incident illustrates the exposure created by third-party cloud services. When a service provider holds copies of a company's records, the security of those records depends on the provider as well as on the company. TSMC's statement that the data matches records held by a third-party cloud service provider places the incident squarely in that category, and it is a reminder that supply-chain and vendor security remains one of the most difficult problems in enterprise cybersecurity.
Third, the episode shows how quickly unverified claims can attach themselves to a confirmed disclosure. The actors' figures for the size of the dataset and the asking price have been widely repeated, but they remain claims. The distinction between what TSMC has confirmed and what the actors claim is the central fact of this story, and it is the distinction on which any responsible account must rest.
What happens next
TSMC is continuing its investigation with the cloud service provider, the investigating authorities and an independent cybersecurity agency. The company is notifying affected employees in phases, which suggests that the notification process is ongoing and that further details may emerge as it proceeds. Whether the actors carry out their threat to publish the full dataset within a week, and whether any further disclosure follows from TSMC or from the authorities, will determine the next stage of the incident.
For the employees affected, the immediate questions are practical: what data of theirs was exposed, what support TSMC is providing, and what steps they should take to protect themselves. The company has not yet published answers to those questions in full, and the phased notification process indicates that those answers will arrive over time rather than at once.
Source: Republic World / ANI; ChosunBiz; CNBC TV18, quoting the TSMC SEC Form 6-K filing of 12 November 2026.
