"TSMC has found that some of our current and former employee data was made available on an external website without authorization," the company wrote in a filing with the Securities and Exchange Commission.
TSMC confirms employee records exposed, says operations unaffected
Taiwan Semiconductor Manufacturing Company (TSMC) verified that personal data belonging to current and former employees has appeared online following a threat actor’s claim to possess a larger dataset. The company said the incident does not affect its operations or its customers. In the same SEC filing, TSMC added, “Currently, we have found no evidence that TSMC’s systems have been compromised.”
What the auction claim contains: 6.9GB, 46,000 records, 3 BTC opening bid
On November 8, a user identifying themselves as “SmithBianl” posted on a hacker forum a text file of 499 rows described as a sample of a 6.9GB dataset. The forum post claimed the dataset contains 46,000 employee records and included sensitive fields such as national ID numbers, addresses, contact details, and banking information. The actor opened bidding at 3 BTC — approximately $65,000 — and warned that if the data did not sell it would be released for free after one week, setting an initial deadline of November 15.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadTSMC links leaked records to a cloud service provider
TSMC said it verified that the leaked information matched “data stored in the system services of a cloud service provider,” a finding the company described as pointing to a breach outside its own infrastructure. In response to the discovery, TSMC is notifying impacted staff and providing necessary support. The company has also engaged a third‑party cybersecurity firm to assist in managing the situation.
Who is affected: employees, the company’s supply relationships, and public confidence
TSMC identified the exposed material as employee personal data and explicitly stated that current and former employees were affected. The company is one of the world’s largest contract chipmakers and serves major customers — the source material names Apple and Nvidia — and reports substantial scale: last year it shipped approximately 15 million 12‑inch‑equivalent wafers and generated $122.4 billion in annual revenue. Despite the scale and the sensitivity of the records involved, TSMC said the leak does not impact its operational capabilities or customer deliveries.
What this means for technologists, affected employees, and procurement teams
- Technologists and security teams: The company’s finding that the leaked data matched records in a cloud service provider’s system services focuses attention on third‑party cloud security and control of data stored outside corporate infrastructure. TSMC’s engagement of a third‑party cybersecurity firm underscores a step many organizations take when a provider‑linked exposure is suspected.
- Affected employees: Individuals whose national ID numbers, addresses, contact details, or banking information may be included should expect notification from TSMC, as the company said it is notifying impacted staff and providing support. The presence of banking information in the sample suggests those employees will need to monitor their financial accounts and communications for follow‑on fraud.
- Procurement and vendor managers: The linkage to a cloud service provider highlights the need to review contractual and technical controls around data placed with external service providers and to coordinate incident response capability with those providers, as TSMC’s public statement frames the issue as an external breach rather than an internal systems compromise.
BleepingComputer contacted TSMC to ask whether the company had engaged with the threat actor or planned to pay to prevent a broader public release; a spokesperson declined to comment at this stage. The threat actor’s stated public deadline and the presence of a marketplace auction indicate a narrow window in which the dataset’s availability could change.
TSMC’s public filing establishes three concrete facts: employee records were made available on an external website without authorization; the company’s verification matched that material to data held in a cloud service provider’s system services; and the company currently finds no evidence of compromise to its own systems. The immediate next steps named in TSMC’s account are notification of impacted staff, providing support, and working with an external cybersecurity firm — actions that will shape how the incident unfolds for those named in the auction post and for the broader set of organizations that rely on cloud providers for personnel data.
Original reporting: BleepingComputer — TSMC employee data breach linked to cloud provider
