TSMC has confirmed that personal information belonging to current and former employees was exposed online, following reports that hackers were selling approximately 46,000 employee records for 3 Bitcoin. However, the Taiwanese semiconductor giant maintains that its internal systems remain secure, with the compromised information matching records stored by an external cloud service provider.
According to Taiwan's Central News Agency, hackers advertised approximately 6.9 GB of allegedly stolen data on underground forums, demanding 3 Bitcoin, equivalent to roughly NT$7.4 million. The attackers reportedly threatened to release the complete database if no buyer emerged within 1 week. As evidence, they published a sample containing 499 employee records, reportedly including names, identification numbers, addresses, bank account information, and emergency contacts. The claimed total number of records has not been independently verified.
In its official statement filed with the US Securities and Exchange Commission on November 12, 2026, TSMC acknowledged the unauthorized disclosure but emphasized that investigators had found no evidence of a breach affecting its internal infrastructure. The company confirmed that the exposed information matched records held by a third party cloud service provider and was unrelated to manufacturing operations or customer information.
TSMC has begun notifying affected employees and providing assistance while working with the cloud provider, investigative authorities, and an independent cybersecurity organization to determine how the information was exposed. The company has not identified the cloud provider or disclosed the exact number of affected individuals.
Although there is currently no evidence that semiconductor designs or manufacturing technologies were compromised, the exposed personal information creates significant risks of identity theft, financial fraud, and targeted phishing attacks against TSMC employees. The incident also raises concerns about security oversight across the semiconductor supply chain, particularly following separate investigations involving alleged leaks of TSMC's 2 nm manufacturing technology.
The latest incident highlights how external service providers can introduce security vulnerabilities even when a company's internal infrastructure remains protected. For TSMC, which manufactures advanced processors for companies including NVIDIA, AMD, and Apple, protecting employee information is essential to maintaining operational security and preventing attackers from exploiting personnel as potential entry points into sensitive environments.
TSMC's response suggests that its manufacturing infrastructure remains unaffected, but the exposure of employee information is still a serious security concern. Outsourcing data storage does not eliminate a company's responsibility to protect sensitive information, particularly when employees can become targets for sophisticated phishing and social engineering attacks. Semiconductor manufacturers should enforce stronger security requirements, independent audits, and strict access controls across external providers. Protecting intellectual property is important, but employee privacy deserves the same level of attention.
Should companies face greater accountability when external cloud providers expose employee information, even if their internal systems were never compromised?
