Threat watch / Breach
TSMC: current and former employee data posted online, matching data held by a cloud provider
Taiwanese chipmaker TSMC said on November 12, 2026 that some current and former employee data "was made available on an external website without authorization". It says the data matches data stored in the system services of a cloud service provider, that it is unrelated to its operations or customer data, and that it has found no evidence its own systems were compromised. According to media reports, a seller on an underground forum offered about 46,000 records (6.9 GB) and asked for three bitcoin.
- Sector
- Tech & SaaS
- Way in
- Supplier
- Product or vendor
- None named
- How it happened
- TSMC says the leaked information "has been verified to match data stored in the system services of a cloud service provider" and that it has "found no evidence that TSMC's systems have been compromised". It does not name the provider or say how the data was taken from it.[1][2] Checked 13 Nov 2026
- What was stolen
- Personal data of some current and former employees, which TSMC says is unrelated to its operations or customer data; it does not list the data types. A sample posted by the seller covers 499 employees and includes addresses, bank account numbers and emergency contacts, according to Wccftech.[1][3] Checked 13 Nov 2026
- Who was impacted
- Some current and former TSMC employees, whom the company says it is informing and supporting. TSMC gives no number.[1] Checked 13 Nov 2026
- Threat actor
- Not attributed
Timeline
- Media reports say a seller on an underground forum is offering TSMC employee information: about 46,000 records totalling 6.9 GB, for three bitcoin, with a threat to release everything if no buyer comes forward within a week. TSMC has not confirmed these figures. [2][3]
- TSMC files a statement with the SEC: some current and former employee data was made available on an external website without authorization, matches data stored with a cloud service provider, and no evidence shows its own systems were compromised. It is informing affected staff and working with the cloud vendor, the relevant investigating authorities and a third-party cybersecurity firm. [1][2]