Current and former TSMC employees had their personal data posted on an outside website without authorization, and the chipmaker says the records match data held by a third-party cloud provider, not its own systems.
TSMC disclosed the leak in a Form 6-K filing with the US Securities and Exchange Commission. The company said it has "found no evidence that TSMC's systems have been compromised." It has told the people affected, is offering them support, and is working with the cloud vendor, investigating authorities and a third-party cybersecurity firm. It did not name the provider. It also said the leaked data has nothing to do with its operations or customers.
The scale and the price tag come from elsewhere. A Taiwanese outlet reported that hackers offered the records on an underground forum for three bitcoin, in exchange for 6.9 GB of data. Another report put the record count at more than 46,000. The same outlet said a sample circulating on other forums appears to include national ID numbers, addresses and banking information. TSMC has not confirmed those details, so treat them as claims.
The wording of the filing is worth reading closely. "Our systems were not compromised" can be true while the data still walks out the door, because the data lived somewhere else. For the employees, that distinction changes nothing. National ID and bank details are what identity fraud runs on, whoever's server they sat on.
There is a pattern here. In 2023, the LockBit ransomware group tried to extort TSMC for $70M after claiming a hack. TSMC said the real victim was its IT hardware supplier Kinmax Technology, which had leaked server setup and configuration information. Two incidents, two vendors, and no confirmed breach of TSMC itself.
The open question is whether the cloud provider's name and the cause of the exposure ever become public. TSMC's filing says the facts are still being ascertained.