TSMC Confirms Employee Data Leak, Seller Claims 46,000 Records

The company said it verified that the data matches information stored in the system services of a cloud service provider. It added that it has found no evidence its own systems were compromised, and that the data is unrelated to its operations or customer-related data. The filing does not name the provider or say how many people are affected.

TSMC said it is informing the impacted personnel and providing support. It has also engaged the cloud service vendor, the relevant investigating authorities and a third-party cybersecurity agency to establish the facts and take action, according to the filing signed by Chief Financial Officer Wendell Huang.

The seller's claims are not confirmed

The numbers behind the sale come from the seller and from press accounts of the forum posts, not from TSMC. PC Gamer, citing Taiwan's United Daily News, reported that hackers offered the records on an underground forum for three bitcoin, in exchange for 6.9 GB of private data. PC Gamer also cited Seeking Alpha for a figure of more than 46,000 employee records.

PC Gamer, again relaying the Taiwanese report, said other forums carried what appears to be TSMC employee data, and that a small sample was released. That sample is said to include national ID numbers, addresses and banking information. TSMC has not confirmed the record count, the price, the file size or which fields were exposed.

Why it matters for the chip supply chain

TSMC's wording places the exposed copy at a vendor, not inside its fabs or corporate network, and says customer-related data was not involved. For the customers that design chips on its nodes, that is the distinction that matters: the filing describes a problem with employee data, not with customer-related or operational data. The risk for the people affected is personal, since identity numbers and bank details are the kind of data used in phishing and impersonation.

The scale of the company is the backdrop: TSMC posted record October revenue of NT$586.89 billion, as Voltgrid reported, so the vendors that hold its data are working for a very large customer. Whether the cloud provider's other clients are affected is not stated in the filing.

Not the first supplier-side incident

PC Gamer notes that TSMC faced a similar situation in 2023, when ransomware group LockBit claimed a hack and sought $70 million. TSMC said then that its IT hardware supplier Kinmax Technology had suffered a cybersecurity incident that led to the leak of server setup and configuration information. In both cases TSMC's position was that the exposure sat at an outside party. Nothing in the sources read for this story links the 2026 cloud provider to Kinmax.

What is not confirmed yet

TSMC has not named the cloud provider, said when it learned of the exposure, or said how the data was obtained. The seller's identity, the 46,000 count, the 6.9 GB size and the 3 bitcoin price are claims reported by the press and unverified. The statement describes the finding on TSMC's own systems as current, so it may change as the investigation continues. Watch for a naming of the vendor, a count of affected employees from TSMC, and any sign the data has been published or sold.