TSMC confirms employee data leak as hackers seek 3 BTC for the records

The breach came to light after hackers claimed to have obtained approximately 46,000 employee records totaling 6.9 GB of data, covering both current and former staff. The information was offered for sale on online forums including DarkForums and BreachForums, with the sellers attaching a one-week deadline before threatening to release the full dataset publicly.

To prove their claim, the hackers released a sample file named 'tsmc.txt' containing 499 records with 19 fields each. The exposed information includes names, national IDs, home addresses, phone numbers, email addresses, bank information, job titles and emergency contacts.

Vendor vulnerability

TSMC stressed that the leak originated with an outside cloud service provider, not its own infrastructure. The company confirmed that no internal system was compromised, and that production operations and customer data remained unaffected. This isn't the first time TSMC has faced such an attack - in mid-2023, the LockBit ransomware group targeted the company through a hardware supplier.

What happens next

TSMC is now notifying affected individuals and working with the cloud vendor, law enforcement and external cybersecurity firms to limit potential fallout. The company has assured investors that production and customer data - the parts of the business that drive revenue and client trust - remain secure.

Key developments to watch include whether the hackers follow through on their threat to publish the full dataset, whether TSMC or its cloud vendor discloses more details about how the data was accessed, and whether regulators in Taiwan or elsewhere investigate the vendor's security controls.