A breach linked to a third‑party supplier exposed personal details of roughly 46,000 TSMC employees, with hackers demanding around 3 BTC for the data.
Taiwan Semiconductor Manufacturing Company (TSMC) confirmed that personal information of thousands of its current and former employees has appeared on underground forums, with a hacker demanding roughly 3 BTC (about NT$7.4 million) for the data. The breach, reported on November 12, adds to a series of third‑party incidents affecting Taiwanese firms.
According to Cryptopolitan, the seller uploaded about 7 GB of files containing records for roughly 46,000 staff members. A sample file named “tsmc.txt” showed 499 entries, each with 19 fields, including names, birth dates, job titles, nationalities, ID numbers, home addresses, personal phone numbers and email addresses. Bank‑account details and emergency‑contact information were also part of the leak, creating a rich source for phishing and social‑engineering attacks.
TSMC issued a statement saying the data appeared on external sites without authorization and that its internal systems were not compromised. The company attributed the exposure to a cloud‑service provider used by an unnamed vendor and is cooperating with external cybersecurity firms and investigators to identify the root cause. TSMC also began notifying affected employees, though it did not confirm the exact number of individuals involved.
The incident follows a June 2023 breach linked to a third‑party hardware supplier, Kinmax Technology, which prompted a ransomware demand that was later reduced. Under Taiwan’s Personal Data Protection Act, firms remain liable for data handled by contractors, and affected workers can claim compensation ranging from NT$500 to NT$20,000 each, with a cap of NT$200 million per incident.
Observers will monitor whether the hackers secure a payment before the one‑week deadline and whether the data is released for free thereafter. TSMC’s ongoing investigation may also reveal additional third‑party security gaps, prompting broader scrutiny of supply‑chain data practices in Taiwan’s semiconductor sector.
Discussion 0