TSMC says employee data posted online came from a cloud provider, not its own systems
Current and former staff are being notified, and the chipmaker says no customer or operational data is involved.
Taiwanese chipmaker TSMC has disclosed to the US Securities and Exchange Commission that some current and former employee data was posted to an outside website without authorisation, with reports citing more than 46,000 records. TSMC says it has found no sign that its own systems were breached, and that the matching data sits in a cloud provider's systems, which it has not named. Reports say the records were offered for three bitcoin on an underground forum in exchange for 6.9 GB of data, while a small sample released elsewhere reportedly included national ID numbers, addresses and banking information. TSMC states the leak has no connection to its operations or customer information, and it has notified those affected, engaged the provider, authorities and a third-party cybersecurity firm, and is working to establish the facts. The incident follows earlier TSMC cases, including a 2023 LockBit extortion claim and a breach at hardware supplier Kinmax Technology.
Why it matters
For the people whose records were exposed, the risk is concrete: a reported sample included national ID numbers, home addresses and banking details, which can be used for fraud and identity theft. The episode also shows that employee data held by outside cloud services can be exposed even when a company's own systems are not compromised. TSMC's disclosure to the US Securities and Exchange Commission and its statement that customer information is unaffected are the key points for those tracking the company's handling of the incident.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.