TSMC breach: data on some current and former employees leaked from a cloud provider’s system
TSMC confirmed on November 12, 2026 that data on some current and former employees was leaked from a cloud provider's system. Sellers claim about 46,000 records.
What happened
Taiwan Semiconductor Manufacturing Company (TSMC), the world’s largest contract chipmaker, confirmed on November 12, 2026 that information on some of its current and former employees had been posted on external websites without authorisation. The company said it activated its incident response process as soon as it found the posting, and that a preliminary comparison indicates the leaked content matches data held in the system of a cooperating cloud service provider — not data taken from TSMC’s own systems. TSMC says there is currently no evidence that its internal IT systems or its wafer manufacturing equipment were compromised, and that the leaked data does not involve its chip manufacturing operations or any customer information. It is providing support to affected employees and is investigating with the cloud provider, law enforcement agencies and third-party cybersecurity firms. The leak surfaced publicly as a sale listing: sellers on underground forums including DarkForums and BreachForums offered the data for 3 bitcoin (about $220,000) and threatened to release it publicly if no buyer came forward within a week. TSMC has not named the cloud provider and has not said how the provider’s data was obtained. This is not the first extortion attempt aimed at TSMC through a partner: in 2023 the LockBit ransomware group demanded $70 million over an incident that investigators traced to hardware supplier Kinmax Technology, not to TSMC’s own network.
Who is affected
The people affected are current and former TSMC employees whose information sat in the cloud provider’s system. TSMC has not disclosed how many people that is, and it has not confirmed the sellers’ numbers or their list of data fields — the distinction matters, and this report keeps the two apart. What TSMC itself confirms is only that some current and former employees’ information was leaked and that it matches the provider’s data. The sellers claim to hold about 46,000 employee records totalling 6.9 GB, and released a sample file said to contain 499 records with 19 fields each; reporting on that sample (Taiwan’s Wind Media, via the Central News Agency’s coverage) lists employee names, dates of birth, job titles, nationalities and national ID numbers, residential addresses, personal phone numbers, email addresses and bank account details, extending even to emergency contacts’ names, phone numbers and addresses. Treat that field list as the sellers’ sample as reported, not as a TSMC-confirmed inventory: if the sample is genuine and representative, the full set is considerably more sensitive than a contact list. TSMC says it is notifying the individuals whose information was exposed.
How serious
On the sellers’ sample, the concrete risk is identity fraud and highly targeted phishing. A national ID number joined to a name, date of birth, home address and bank account details is material for impersonating a person to a bank or a government service, and it does not expire the way a card number does. The job titles and reporting lines in such a set also let criminals impersonate human-resources staff or managers convincingly — the Taiwan Information Security Association made exactly that point about this leak, warning that criminals could pose as HR or management to contact employees and even their families, whose details appear in the emergency-contact fields. The sellers’ one-week deadline adds a second risk: if the data is dumped publicly rather than sold to one buyer, it becomes available to every scammer at once. All of that is conditional on the sample being what the sellers say it is; TSMC’s confirmation establishes that a real leak of employee data from its provider occurred, but not yet its size or its exact contents.
What to do now
If you work at TSMC or used to, follow the company’s own notification if one reaches you, and act on the assumption that your details may circulate: watch bank accounts for unfamiliar transactions, and treat any message, call or email that claims to be from TSMC human resources, a manager or a bank as unverified until you have confirmed it through a channel you already trust — a genuine HR process will not ask you to hand over passwords, one-time codes or bank credentials to “confirm” your identity after a breach. Because emergency contacts appear in the sample, warn the family members you listed that they may receive convincing calls using your name, job and workplace as proof. If you suspect fraud, report it promptly — in Taiwan, the 165 anti-fraud hotline is the standing route — and keep any messages you receive, since they are evidence. If TSMC or the provider later confirms the field list or a count, this report will be updated; until then, do not treat the sellers’ 46,000 figure as established, and do not treat silence as proof you are unaffected if the company is still notifying people.
Sources: Crypto Briefing, “TSMC confirms employee data leak as hackers seek 3 BTC for the records,” November 12, 2026 · KuCoin News (TechFlow), “Hacker demands 3 BTC for 6.9GB of TSMC employee data,” November 12, 2026 (reporting Taiwan’s Central News Agency, Business Weekly and Wind Media, and TSMC’s November 12 statement)