TSMC data breach affects 46,000+ workers, offered for sale for three bitcoin

Full text

TSMC, the juggernaut that produces roughly 90% of the world's most advanced chips, has discovered a data leak said to contain over 46,000 employee records, according to Seeking Alpha .

The company made a Form 6-K filing with the US Securities and Exchange Commission on Thursday, stating: "TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC’s systems have been compromised."

The company says the info has been verified to match data "stored in the system services of a cloud service provider," although said provider is not named. TSMC says it has informed those impacted by the breach and is providing support, and has also engaged with the cloud service vendor, investigating authorities, and a third-party cybersecurity agency to "ascertain the facts and take necessary actions."

Taiwanese outlet United Daily News reports that hackers were allegedly offering the employee records on an underground forum for the princely sum of three bitcoin, in exchange for 6.9 GB worth of private data.

The outlet also says that, "according to information online" (via machine translation), hackers were also selling what appears to be TSMC employee data on other forums, releasing a small sample which is said to contain a vast array of personal details, including national ID numbers, addresses, and banking information.

(Image credit: TSMC) TSMC has confirmed in its statement that the leaked data is unrelated to the company's operations, or customer-related information.

This isn't the first time TSMC has been in the headlines in relation to cybersecurity. Back in 2023, ransomware outfit LockBit attempted to extort the company for $70 million after a claimed hack.

TSMC denied it had been directly hacked , revealing in a statement that IT hardware supplier Kinmax Technology had been the victim of a "cybersecurity incident" instead, which "led to the leak of information pertinent to server initial setup and configuration." Kinmax also released a statement at the time confirming the breach .

Being such a large and wealthy company at the heart of the tech supply chain, it's no surprise that hackers are keen to gain any details on TSMC if they can. In both these cases, it seems that TSMC's own systems remained secure, but an outside party may have let the side down.

Regardless, I doubt it's the last major data leak I'll be writing about before 2026 is out. This year has been characterised by cybersecurity incidents left, right and centre, and in this every-more-interconnected world, it seems even some of the most security-conscious companies are far from immune.