TSMC Confirms Employee Data Leak as Hackers Seek 3 BTC
TSMC confirmed employee personal data appeared online without authorization. Forum sellers want 3 BTC for a claimed 46,000 records and 6.9 GB of data. TSMC says the records matched data held by an unnamed cloud provider and its own systems show no breach.
3 BTC. About $220,000. That is the asking price sellers on underground forums have put on a database they claim holds roughly 46,000 TSMC employee records and 6.9 GB of data.
On 12 November, TSMC confirmed that personal information of some current and former employees had appeared online without authorization. The sellers threatened to publish the data within a week if no buyer came forward. Local media reports place the listings on DarkForums and BreachForums.
No payment has been publicly verified. TSMC has not verified the 46,000-record figure.
What was exposed
Samples shared on the forums reportedly contained names, national ID numbers and bank account details, according to a Taiwan News report. Taiwanese outlet Business Next reported the same data types.
TSMC's position
TSMC says the leaked records matched data held by a cloud service provider. It has not named the provider or said what service it handled. The company's own review found no evidence that TSMC systems were breached, and it said customer information and production-related data were not affected.
Affected individuals have already been notified, TSMC said. It is working with the provider, cybersecurity firms and law enforcement to trace where the leak originated.
Market reaction
TSMC's US-listed shares opened 4.53% lower at $394.62 on 12 November. They clawed back ground to close at $405.49, down 1.90%. The VanEck Semiconductor ETF (SMH) tracked a similar path: open down 4.33%, close down 1.03%.
Chip stocks were under broad pressure that day. How much of TSMC's drop came from the leak is hard to separate.
Context
TSMC's account points to third-party exposure, not a direct compromise. Its annual filing says it sets security or confidentiality requirements for outside providers. In 2023, it cut off data exchange with supplier Kinmax after a breach exposed server setup information.
Other Taiwanese companies are dealing with similar problems. Travel platform EzTravel exposed data of more than 690,000 customers. Bank SinoPac reported unauthorized transfers of NT$41.76 million.
Open questions: whether the 46,000 figure holds up, which provider held the data, and whether the sellers publish inside their one-week window.
