A hacker is offering an alleged 6.9GB database containing 46,000 TSMC employee records for 3 BTC. A reported sample includes national identification numbers, banking details and emergency con
Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed the unauthorized exposure of employee information after a hacker advertised an alleged personnel database for 3 Bitcoin.
The chipmaker said on November 12 that preliminary findings traced the records to a third-party cloud service provider. Its internal systems showed no evidence of intrusion, while semiconductor production and customer information remained unaffected.
The disclosure comes more than three years after a separate supplier breach involving TSMC, renewing questions about how the company protects sensitive information held outside its own infrastructure.
According to Taiwan’s Central News Agency, an underground seller claimed to possess approximately 6.9GB of information covering 46,000 employees.
The asking price was 3 BTC, reportedly worth around NT$7.4 million ($220,000), with the seller threatening to publish the database if it remained unsold after one week.
Separate reporting identified DarkForums and BreachForums as platforms associated with the listing.
A sample file named tsmc.txt reportedly contained 499 records organized across 19 fields, including national identification numbers, banking information, home addresses and emergency contacts.
These details are attributed to reporting on the alleged sample rather than independent authentication of the dataset. TSMC has not confirmed the advertised total.
The combination of identity documents and financial information creates potential opportunities for impersonation and account-related fraud. Emergency-contact records could also allow attackers to approach relatives or colleagues using employment details that make fraudulent communications appear credible.
TSMC said the leaked information matched records maintained by an external cloud provider. The company has begun notifying affected current and former employees while coordinating its investigation with the vendor, law enforcement and cybersecurity specialists.
The cloud provider’s identity and the mechanism used to access the information remain undisclosed.
For employees whose national identification or banking information may have been exposed, Taiwan’s Joint Credit Information Center (JCIC) provides access to personal credit reports through its official services.
Reviewing credit activity can help identify unfamiliar borrowing or credit inquiries. Employees should also verify unexpected banking requests through established financial institution channels rather than responding to links or telephone numbers supplied in unsolicited messages.
These precautions are particularly relevant when attackers possess enough personal information to make fraudulent requests appear legitimate.
In June 2023, IT supplier Kinmax Technology disclosed a cybersecurity intrusion affecting a testing environment used for server setup and configuration.
The LockBit ransomware group subsequently demanded $70 million and threatened to publish stolen information.
TSMC said the incident did not disrupt its operations and suspended data exchanges with Kinmax while investigating the exposure.
The two incidents involve different information categories. The earlier case concerned technical configuration data, while the latest centers on employee records and associated privacy risks.
The recurrence of supplier-related exposure does not establish a common attacker or technical vulnerability. It does, however, place renewed attention on the security requirements imposed on external organizations handling TSMC information.
Taiwan’s Personal Data Protection Act establishes requirements for protecting personal information and responding to security failures.
The statutory framework includes administrative fines reaching NT$15 million for certain serious private-sector violations under Article 48.
Whether those provisions apply to the current incident depends on the facts established by investigators, the responsible entities and the effective dates of the relevant legal requirements.
Taiwan’s November 2025 amendments also introduced changes to the data protection framework, with implementation timing relevant to determining the applicable obligations.
Regulators may examine how the employee information was transferred, stored and accessed, including the contractual and technical safeguards maintained by the external provider.
For investors, the immediate financial exposure is concentrated in investigation, remediation, compliance and potential legal costs rather than an identified interruption to chip manufacturing.
TSMC has not disclosed an estimate of those expenses.
The central unresolved issue is how employee records became accessible through the cloud provider’s environment.
Investigators must establish whether the exposure resulted from compromised credentials, excessive access permissions, inadequate storage controls or another security failure.
The findings will also determine whether the affected information was limited to the advertised sample or extended across a larger personnel database.
For TSMC, the next substantive disclosure will need to establish the number of affected individuals, the categories of exposed records and the measures introduced to prevent further unauthorized access.
The incident leaves the company’s semiconductor operations intact, but puts its management of sensitive employee information across external systems under scrutiny.
The post TSMC Employee Data Leak Raises Fresh Supplier Security Concerns appeared first on ETHNews.
