TSMC Confirms Employee Data Appeared on External Website; Cloud Provider Under Investigation
Summary
TSMC confirmed employee data appeared on an external website and matched records held by an unnamed cloud provider. A seller’s claim of about 46,000 records remains unverified; TSMC says it found no evidence its own systems were compromised.
Key points
- TSMC said current and former employee data was made available on an external website without authorization.
- The company said the data matched records held by an unnamed cloud service provider, and reported no evidence that TSMC’s own systems were compromised.
- A seller reportedly claims to have about 46,000 records and threatens publication unless paid 3 Bitcoin; TSMC has not confirmed the count.
- Media reports cite home addresses, bank account numbers and emergency contacts, but TSMC did not specify the exposed data types.
- TSMC said the data is unrelated to its operations and customer data, and that it is notifying affected staff and investigating with the cloud provider, authorities and an outside cybersecurity firm.
Article Details
- Victim Organization
- Taiwan Semiconductor Manufacturing Company (TSMC)
- Incident Type
- Unauthorized exposure of current and former employee data held in a third-party cloud service provider's systems. TSMC reported no evidence that its own systems were compromised.
- Disclosure Date
- 2026-11-12
- Data Types Exposed
- Personal data of current and former employees
- Home addresses (reported by media)
- Bank account numbers (reported by media)
- Emergency contact details (reported by media)
- Affected Records
- The seller claimed about 46,000 records; this figure is unverified. Some reports instead cite 49,000 files. TSMC confirmed only that some employee data was exposed and did not provide a count.
- Affected Data Size
- 6.9GB, as reported by media; not confirmed by TSMC.
- Operational Impact
- No operational impact was reported. TSMC said the exposed data was unrelated to company operations and customer data, and that it had found no evidence its systems were compromised.
- Ransom Or Extortion
- A seller reportedly offered about 46,000 records for 3 Bitcoin and threatened to publish the full set unless paid. The seller's claims and the record count are unverified.
- Claim Status
- confirmed