TSMC employee data breach traced to a cloud provider

TSMC has disclosed that personal data belonging to current and former employees appeared on an external website, with the company stating there is no evidence of compromise to its own systems. In a filing to the U.S. Securities and Exchange Commission on 12 November 2026, TSMC noted that the leaked data has been verified as matching information held by a cloud service provider and that the breach concerns data stored by that third party rather than TSMC’s own networks.

Taiwanese media have reported a dump about 6.9GB in size, including home addresses, bank account numbers and emergency contact details, though TSMC has not specified the exact data types or total count.

Claims about the number of records vary: a seller has purportedly put the figure at 46,000, though this is unverified by TSMC and other outlets cite figures up to 49,000 files. The company has not named the supplier nor explained how attackers gained access to the vendor’s systems. The seller has reportedly threatened to publish the full dataset unless payment of around 3 Bitcoin is received.

The breach affects current and former employees, with TSMC emphasising that the data exposed is unrelated to the company’s operations or customer data such as chip designs or production information. In its response, TSMC says it is informing affected staff, providing support, and engaging the cloud vendor, authorities and an external cybersecurity firm to establish the facts and determine next steps.