Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed that personal data belonging to some current and former employees was posted on an external website without authorisation. It disclosed the leak in a Form 6-K filing with the US Securities and Exchange Commission on November 12, 2026. The company says the leaked data matches records held in a cloud service provider's systems and that it has found no evidence its own systems were breached. The people selling the data claim to hold about 46,000 employee records, around 6.9 GB, and are asking 3 Bitcoin for it. CNBC TV18 and Barchart value that at about $220,000. Taiwan News and Business Next put it at about NT$7.4 million. TSMC has not said how many people are affected or named the cloud provider.
What Happened
Taiwanese media first reported that anonymous sellers on the underground forums DarkForums and BreachForums were offering what they said was TSMC employee data. Taiwan News and Business Next report that the sellers threatened to publish the data if no buyer came forward within a week.
Outlets describe the demand differently. Taiwan News and Business Next describe a sale: pay 3 Bitcoin for the data, or it gets dumped publicly. Wccftech and Digital Citizen describe it as a ransom paid to keep the data private. Either way, the pressure is the same: pay, or the records become public.
TSMC responded on November 12. In its SEC filing, signed by Senior Vice President and CFO Wendell Huang, the company said: "TSMC has found that some of our current and former employee data was made available on an external website without authorisation. Currently, we have found no evidence that TSMC's systems have been compromised." The filing says the data "has been verified to match data stored in the system services of a cloud service provider" and is "unrelated to the company's operations or customer-related data."
TSMC says it is notifying affected staff and offering them support. It is also working with the cloud provider, investigating authorities and an outside cybersecurity firm. It has not named the provider or said what service the provider supplied. Barchart reported that TSMC shares fell on the news.
What Was Taken
How many records: Most reports give the sellers' figure of about 46,000 records, or 6.9 GB. Wccftech's headline says 49,000, but its own article gives 46,000, so the higher number looks like an error. Barchart attributes the 46,000 figure to TSMC management, but the company's SEC filing gives no number. Business Next notes that the actual number of people affected has not been disclosed. For now, 46,000 is the sellers' claim, not a confirmed count.
What kind of data: TSMC has not listed which fields were exposed. Everything below comes from a sample file the sellers posted, called tsmc.txt. Business Next, Wccftech and Digital Citizen report that it covers 499 employees. Business Next reports 19 fields per record:
- Name, date of birth, job title and nationality
- National ID number
- Home address, mobile number and email address
- Bank account details
- Emergency contact names, phone numbers and addresses
Business Next stresses that these fields come from the sellers' sample and have not been verified. If the sample is genuine, the leak exposes more than contact details. National ID numbers and bank details make identity fraud possible. Emergency contact entries also expose employees' family members and friends, who never had any relationship with TSMC.
Why It Matters
Supply chain exposure, not perimeter failure. TSMC's own network may never have been breached, and it still lost control of its HR data. Defenders should take that seriously. Business Next points out that two other recent Taiwanese incidents also involved outside vendors. At 91APP, an unpatched flaw in the third-party tool Appsmith exposed order data. At Bank SinoPac, security settings in a vendor-supplied online banking system were exploited, and 418 customer accounts lost a combined NT$41.76 million in unauthorised transfers. The publication cautions that the cause of TSMC's leak has not been established.
A cluster of Taiwanese incidents. The TSMC leak follows several others in Taiwan within about five weeks: - 104 Job Bank: about 120,000 résumés accessed without authorisation - 91APP: order data for about 4.79 million shoppers across 1,329 brands potentially exposed - Bank SinoPac: the unauthorised transfers described above - EzTravel: data on more than 690,000 customers exposed
No public reporting links these incidents to the same attacker.
Employees at TSMC are valuable targets. Wccftech notes that TSMC staff hold scarce, valuable expertise, and that Taiwanese authorities have previously said they were countering attempts by Chinese firms, including SMIC, to recruit semiconductor talent. A list of names, job titles, home addresses and phone numbers is useful for targeted phishing, impersonation and recruitment approaches. That holds even though the data contains no trade secrets.
The Attack Technique
How the data was taken has not been disclosed. TSMC says the leaked records match data stored with a cloud service provider and that it has found no evidence of a breach of its own systems. It has not said whether the provider was hacked, misconfigured a storage system, or had its data exposed some other way.
The sellers posted on DarkForums and BreachForums using anonymous seller accounts. No known extortion or ransomware group has claimed the attack, and the sellers have not been publicly identified. The 499-record sample is a common tactic to prove the data is real and push the victim to pay before the deadline.
What Organizations Should Do
- Map where HR data sits outside your network. Payroll, benefits, HR software, background checks and travel providers often hold national ID numbers and bank details. Know every vendor that holds them, what fields they hold, and how long they keep them.
- Require breach notification and audit rights in vendor contracts. Contracts should set short notification deadlines, give you the right to check how the vendor configures and stores your data, and require deletion of data on former employees. TSMC's leak included former staff.
- Send vendors only the data they need. Ask whether each vendor really needs national ID numbers, bank accounts or emergency contact details. Mask or tokenise those fields wherever the service still works without them.
- Watch underground forums for your company's name. In this case the sellers' forum posts came to light before TSMC's disclosure. Monitoring DarkForums, BreachForums and similar sites can give you advance warning.
- Warn employees and their families about follow-up scams right away. Business Next advises affected people to watch for callers pretending to be TSMC HR, the employee welfare committee or a bank, and for "your relative has had an accident, send money" calls aimed at emergency contacts. Staff should check credit reports, turn on bank transaction alerts, and verify unexpected requests through official channels. In Taiwan, they can call the 165 anti-fraud hotline.
- Expect a public data dump. Plan as if the full dataset will be released when the one-week deadline passes, whether or not anyone pays. Have helpdesk scripts, account-reset steps and identity-protection support ready.
Sources: TSMC confirms employee data leak; hackers demand 3 Bitcoin for 46,0... | TSMC reports leak of employee information | TSMC employee data exposed on external website TSM SEC Filing - Fo... | Taiwan Chip Giant TSMC Acknowledges Hack Of Reportedly 49,000 Emplo... | 台積電個資外洩｜台積電員工資料外洩哪些？雲端廠商是誰、能求償嗎數位時代 BusinessNext | TSMC Reports Unauthorized Exposure of Employee Data on External Web... | A Massive Employee Data Leak Is Dragging Down TSM Stock | TSMC Confirms Employee Data Breach Linked to External Cloud Provide...