TSMC confirmed on 12 November that personal data belonging to some of its current and former employees had been posted on external websites without authorisation. TSMC says its preliminary findings indicate the leaked data matches information held by a cloud service provider it works with, and that there is currently no evidence its own systems were compromised. Chip production and customer data were not touched, the company says.
That is the confirmed part. The louder part is only a claim. A seller on underground forums says they hold about 46,000 TSMC employee records, 6.9 GB in total, and wants 3 bitcoins, roughly $220,000 at the time of the listing, for the lot, with a threat to publish everything publicly if nobody buys within a week. TSMC has not confirmed that number, named the vendor, or said how many people are affected.
TSMC’s US-listed shares fell 1.90% on Thursday 12 November, the day the leak was acknowledged, Nasdaq data shows.
What TSMC actually confirmed
TSMC’s statement, reported by Taiwan’s Central News Agency and Current Weekly and carried in English by TechFlow via KuCoin News, is short and specific. The company says it started its incident response as soon as it found employee information had been posted on external websites without authorisation, and it has begun notifying affected employees and giving them help. TSMC put the same confirmation in a Form 6-K filing with the US Securities and Exchange Commission the same day, signed by chief financial officer Wendell Huang, the filing shows.
The preliminary finding is the sentence that matters most. TSMC says the leaked content matches data held in the systems of a cloud service provider it works with, and that there is currently no evidence its own systems were compromised. The leaked content does not involve chip manufacturing operations or customer-related information, according to the same statement, as reported by Cointime.
TSMC is working with the cloud provider, law enforcement agencies and third-party cybersecurity firms to investigate, KuCoin News reports. Taiwan’s Ministry of Digital Affairs said it grasped the situation immediately and reminded companies that after a personal-data breach they should notify the competent authority within 72 hours, individually notify affected consumers, and identify the cause and patch vulnerabilities to prevent further damage, BigGo Finance reports.
TSMC is the world’s largest contract chipmaker, commanding about 60% of the global foundry market, TechCrunch reported. It makes the A-series and M-series chips used in Apple devices, according to MacRumors, so an incident that hits Taiwanese employees still lands on a company most American readers know by name.
What the seller claims, and what the 499-record sample proves
The incident first surfaced on underground forums including DarkForums and BreachForums, where the seller named TSMC and released a sample file called “tsmc.txt”, according to CNA and Current Weekly as reported by KuCoin News and BigGo Finance. The sample contains 499 employee records, each with 19 fields, BigGo Finance reports.
The fields in the sample reportedly include names, dates of birth, job titles, nationalities, national ID numbers, addresses, mobile phone numbers, email addresses and bank account information, plus emergency contacts’ phone numbers and addresses, BigGo Finance reports. That is the kind of detail that can lead to identity theft, financial fraud and targeted cyberattacks, BigGo Finance notes, which is why the sample matters more than the headline number.
Cheng Chia-hai, a supervisor at the Taiwan Information Security Association and general manager of Junmeng Technology, warned that once personal data reaches underground markets, attackers can use it to launch precision attacks. He advised companies to trace the source of the leak, tighten internal permissions and proactively notify employees of the risks, and reminded staff and their families that someone knowing their personal data does not mean their identity can be trusted. Anything involving money, accounts or verification codes should be re-verified, and multi-factor authentication should be enabled. He also noted that leaked employee data can be used for talent intelligence analysis, such as poaching or social engineering aimed at specific individuals, BigGo Finance reports.
Here is the check that keeps the headline honest. The public sample is 499 records. The seller claims about 46,000. That means the reported sample covers roughly 1.1% of the seller’s claimed haul, and whether the rest is genuine remains to be verified, BigGo Finance reports. The 6.9 GB total and the 3 BTC price tag are also the seller’s figures, not TSMC’s.
Two things the seller’s listing is not. No ransomware group has been named in connection with this leak, and no ransom demand against TSMC itself has been reported. The 3 bitcoins, about NT$7.4 million or roughly $220,000 at the time of the listing, is an asking price for a buyer on a forum, not a ransom demanded from TSMC.
2023 vs 2026: the same weak link, a much cheaper price tag
This is the second publicly reported TSMC data incident in roughly three years involving information held by a third-party provider. In late June 2023, the LockBit group listed TSMC and demanded $70 million, but the investigation showed the actual target was Kinmax, a TSMC hardware supplier, not TSMC’s own systems, TechCrunch reported at the time.
The pattern is the story. In both cases, the information sat with a third-party provider, not with TSMC itself. The 2023 incident hit a hardware supplier’s testing environment; the 2026 incident, by TSMC’s preliminary account, involves data held by a cloud provider.
| June-July 2023 (LockBit / Kinmax) | November 2026 (cloud vendor) | |
|---|---|---|
| Point of failure | Hardware supplier Kinmax | Unnamed cloud service provider |
| TSMC’s own systems breached? | No | No evidence so far |
| Data involved | Server setup and configuration information held by Kinmax | Employee PII: names, national IDs, bank accounts |
| Ransom demand / asking price | $70 million ransom | 3 BTC, about $220,000, asking price |
| Customer / production data | TSMC said operations and customer information were not affected | TSMC says exposed information was unrelated to production and customer data |
And the price tells its own story. The 2026 asking price of about $220,000 is roughly 0.31% of the $70 million LockBit demanded in 2023, our calculation from the two figures. The two numbers are not the same kind of thing: one is a ransom demand for server setup information, the other an asking price for an alleged employee dataset. The ratio between them is roughly 318 to 1.
What should I do if my employer’s data was leaked?
Start with your money and your passwords. Watch your bank statements, change every password you reused between work and personal accounts, and pull your credit report to check for accounts you never opened. Be alert to messages that quote your job title or emergency contacts, and verify the sender another way before acting on them.
- Check your bank statements daily for charges you do not recognise, and tell your bank at once about anything odd.
- Change every password you reused between work and personal accounts, starting with email and banking.
- Get your free annual Chinese-language credit report from the Joint Credit Information Center; check for accounts you never opened.
- Be alert to messages quoting your job title or emergency contacts, and verify the sender before acting on them.
- Turn on two-factor authentication on email, banking and cloud accounts, using an authenticator app where offered.
- Save TSMC’s notification letter and any suspicious messages, in case you need them for a report or a claim.
What to watch next
Four things will decide how big this gets. First, whether TSMC names the cloud vendor or confirms a victim count. Second, whether Reuters, BleepingComputer or The Register pick the story up. Third, whether the seller follows through on the one-week threat and publishes the full dataset, which would fall around 18–19 November, depending on when the seller’s one-week period began. Fourth, whether Taiwan’s Ministry of Digital Affairs takes any action over the cloud provider, which TSMC has not named.
Read Also: 2026 Breaches by the Numbers: every confirmed incident this year, with victim counts
