TSMC confirms employee data leak through a cloud service provider

TSMC, the world's largest contract chipmaker, has confirmed that data on some of its current and former employees was posted on an external website without authorisation. In a statement filed with the US Securities and Exchange Commission on Thursday, the company said the data matches records held in the systems of a cloud service provider, and that it has so far found no evidence that its own systems were compromised.

TSMC says the exposed data is unrelated to its operations and to customer data. It has not named the cloud provider, said what kinds of personal data were exposed, or said how many people are affected. It is informing affected staff and working with the provider, the relevant investigating authorities and an outside cybersecurity firm to establish what happened.

The listing behind the disclosure

The statement followed a sale listing first flagged on 9 November, in which a seller claimed to hold employee personal and confidential information tied to TSMC. According to reports of the listing on the DarkForums and BreachForums criminal forums, the seller says the 6.9 GB dataset holds about 46,000 employee records, is asking 3 bitcoin for it, and has set a one-week deadline before releasing it publicly. TSMC has not confirmed the size of the dataset or the number of records.

Why the cloud provider matters

TSMC's wording places the source of the data with a supplier rather than its own network: the leaked records were "verified to match data stored in the system services of a cloud service provider". If that holds, the breach sits with a third-party service that held employee records, not with TSMC's manufacturing or design systems. TSMC has not said which service it was or whether other customers of the same provider are affected.

What is not known

TSMC has not said when the provider was breached, how the attacker got access, which employees and former employees are affected, or whether it will notify regulators in other countries where it employs staff. No group has been publicly tied to the sale beyond the forum seller.