Taiwan Semiconductor Manufacturing Company (TSMC) confirmed that personal information of thousands of its current and former employees has appeared on underground forums, with a hacker demanding roughly 3 BTC (about NT$7.4 million) for the data. The breach, reported on November 12, adds to a series of third‑party incidents affecting Taiwanese firms.

BTC / USD
Source: CoinGecko. Prices are indicative.

Scope of the leaked data

According to Cryptopolitan, the seller uploaded about 7 GB of files containing records for roughly 46,000 staff members. A sample file named “tsmc.txt” showed 499 entries, each with 19 fields, including names, birth dates, job titles, nationalities, ID numbers, home addresses, personal phone numbers and email addresses. Bank‑account details and emergency‑contact information were also part of the leak, creating a rich source for phishing and social‑engineering attacks.

TSMC’s response and cause

TSMC issued a statement saying the data appeared on external sites without authorization and that its internal systems were not compromised. The company attributed the exposure to a cloud‑service provider used by an unnamed vendor and is cooperating with external cybersecurity firms and investigators to identify the root cause. TSMC also began notifying affected employees, though it did not confirm the exact number of individuals involved.

The incident follows a June 2023 breach linked to a third‑party hardware supplier, Kinmax Technology, which prompted a ransomware demand that was later reduced. Under Taiwan’s Personal Data Protection Act, firms remain liable for data handled by contractors, and affected workers can claim compensation ranging from NT$500 to NT$20,000 each, with a cap of NT$200 million per incident.

What to watch next

Observers will monitor whether the hackers secure a payment before the one‑week deadline and whether the data is released for free thereafter. TSMC’s ongoing investigation may also reveal additional third‑party security gaps, prompting broader scrutiny of supply‑chain data practices in Taiwan’s semiconductor sector.