TSMC Confirms Employee Data Breach as Seller Seeks Bitcoin for 46K Records - Security Boulevard

The chipmaker stated in a Nov. 12 SEC filing that personal information belonging to current and former employees was posted online. "TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC's systems have been compromised," the company said.

The exposed information was unrelated to TSMC's operations or customer data, though the company did not specify what personal information was involved. The disclosure followed reports that a seller on an underground forum claimed to possess about 46,000 employee records totaling 6.9 gigabytes.

Bitcoin ransom demand

Taiwan's Central News Agency reported the seller was seeking three bitcoins for the collection. Cybernews reported that the seller also posted a sample file allegedly containing information about 499 employees, including home addresses, bank account numbers and emergency contacts.

Investigation ongoing

Although TSMC has linked the exposed records to data stored with a cloud provider, it has not disclosed how the information was obtained or identified the provider. The company has been notifying affected personnel and providing support while working with the cloud provider, investigating authorities and an independent cybersecurity firm.

This is not TSMC's first security incident involving an outside supplier. In 2023, a cyberattack on IT hardware supplier Kinmax Technology exposed information related to server setup and configuration, though TSMC said its operations and customer information were unaffected at that time.