TSMC Confirms Employee Data Leak

Taiwanese company TSMC, one of the world's largest semiconductor manufacturers, confirmed on November 12, 2026, the unauthorized posting of personal data of current and former employees on external websites. An unknown seller had previously listed what was claimed to be a company database on an underground forum for 3 bitcoins (BTC). However, TSMC found no evidence of a breach in its own information systems.

Hacker Claims to Sell 46,000 Records

According to Taiwanese media reports, the seller claims to have an archive of 6.9 GB containing about 46,000 records of TSMC employees. The information was priced at 3 BTC, which journalists estimated to be approximately 7.4 million New Taiwan dollars. The perpetrator threatened to publish the archive if a buyer is not found within a week.

TSMC confirmed the disclosure of some personal information but did not specify the exact number of affected individuals. The authenticity of all the offered records and the claimed volume of the archive have not been independently verified.

TSMC Found No Breach in Its Systems

According to preliminary data from the manufacturer, the disclosed information corresponds to data stored in the system of one of its third-party cloud service providers. The company did not disclose the provider's name or the circumstances of the potential security breach.

TSMC emphasized that the incident did not affect information about production processes and clients. However, the absence of detected signs of an internal system breach does not rule out data compromise through external infrastructure.

Company Initiates Investigation into the Leak

TSMC is notifying affected employees and providing them with necessary assistance. The company is also cooperating with the cloud provider, law enforcement agencies, and independent cybersecurity experts to determine the circumstances of the incident.

At the time of publication, the method by which the perpetrator obtained the information remained unknown. The manufacturer also did not report whether the identity of the data seller had been established.