Do Son 
At a Glance
| Organization | Taiwan Semiconductor Manufacturing Company (TSMC) |
| Data exposed | Current and former employee personal data; reports cite home addresses, bank account numbers and emergency contacts |
| People affected | About 46,000 records – claimed by the seller, not confirmed by TSMC |
| Cause | Data held in a third-party cloud service provider’s systems; vendor not named |
| Disclosure status | Confirmed by TSMC in an SEC Form 6-K on November 12, 2026 |
TL;DR
TSMC has confirmed that personal data of current and former employees appeared on an external website. The chipmaker says the leaked data matches records held by a cloud service provider, not its own systems. A seller is reportedly asking 3 Bitcoin for about 46,000 records.
What Was Exposed
In its filing, TSMC said “some of our current and former employee data was made available on an external website without authorization.” The company did not list the data types or a record count.
However, Taiwanese media reports fill in some gaps. According to Wccftech, the dump is 6.9GB in size. It reportedly includes home addresses, bank account numbers and emergency contact details.
Claimed vs. Confirmed Counts
The 46,000 figure comes from the seller, so it remains unverified. Some reports cite 49,000 files instead, and none explains the gap. TSMC has confirmed only that some employee data leaked, not how much.
How It Happened
TSMC points to a supplier, not its own network. “Currently, we have found no evidence that TSMC’s systems have been compromised,” the company stated. It added that the data “has been verified to match data stored in the system services of a cloud service provider.”
So far, TSMC has not named the vendor. It also has not said how the attackers reached that vendor’s systems. Meanwhile, the seller reportedly threatens to publish the full set unless someone pays 3 Bitcoin.
Who Is Affected
The TSMC data breach touches current and former employees. By contrast, TSMC says the data “is unrelated to the company’s operations or customer-related data.” In other words, chip designs, production data and client information are not part of this TSMC employee data leak, based on what the company knows today.
What Affected People Should Do
- Watch your bank accounts for unusual activity, and alert your bank if you see any.
- Expect phishing calls and messages that use your home address or HR details.
- Warn the people listed as your emergency contacts about possible scam calls.
- Only trust breach notices that come through official TSMC channels.
Company Response
TSMC says it is informing affected staff “and providing them with necessary support.” Furthermore, it has engaged the cloud vendor, investigating authorities and an outside cybersecurity firm “to jointly ascertain the facts and take necessary actions.”
The case adds to growing concern about third-party risk in the chip supply chain. Even when a company’s core network holds firm, suppliers can still expose its staff.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
