Taiwan Semiconductor Manufacturing Company (TSMC), one of the world’s leading semiconductor manufacturers, has confirmed that personal information belonging to some current and former employees was made available on an external website without authorization.
The disclosure came on November 12, 2026, after reports emerged that hackers were allegedly offering a database containing approximately 46,000 TSMC employee records for sale on underground cybercrime forums.
According to reports, the alleged database contains around 6.9 GB of data, with the sellers demanding 3 Bitcoin (BTC), valued at approximately $220,000 or nearly ₹2.07 crore at the time of reporting. The threat actors have reportedly warned that they could release the complete dataset publicly if no buyer comes forward within one week.
In its official filing with the U.S. Securities and Exchange Commission (SEC), TSMC confirmed the unauthorized exposure of some employee information. However, the company stated that it had found no evidence that its own systems were compromised.
TSMC also clarified that the exposed information was associated with data stored in the system services of a cloud service provider and was unrelated to its company operations or customer-related information.
What Happened in the TSMC Employee Data Leak?
On November 12, 2026, TSMC publicly acknowledged that some personal information belonging to current and former employees had been made available on an external website without authorization.
The incident came to light after threat actors reportedly claimed to have obtained a large collection of employee records and advertised the database on underground forums, including DarkForums and BreachForums.
According to reports from Taiwanese media, the sellers claimed that the dataset contained:
- Approximately 46,000 employee records
- Around 6.9 GB of data
- Personal information belonging to current and former employees
- An asking price of 3 Bitcoin
The sellers reportedly demanded 3 BTC, equivalent to approximately $220,000 or nearly ₹2.07 crore at the time of reporting. They also allegedly gave potential buyers one week to make an offer, threatening to publish the complete dataset if no deal was reached.
However, TSMC has not officially confirmed the claimed number of records, the dataset size or the ransom demand.
What Did TSMC Confirm in Its Official SEC Filing?
TSMC submitted an official Form 6-K filing to the U.S. Securities and Exchange Commission on November 12, 2026.
In its statement, the company confirmed that some personal information belonging to current and former employees had been exposed without authorization.
The company stated that it had found no evidence that TSMC’s own systems were compromised.
TSMC also confirmed that the exposed information matched data stored in the system services of a cloud service provider.
The company provided the following important details:
- Employee information exposed: Some personal information belonging to current and former employees was made available on an external website without authorization.
- No evidence of internal system compromise: TSMC said it had found no evidence that its own systems were compromised.
- Third-party cloud connection: The exposed information matched data stored in the system services of a cloud service provider.
- No production or customer-related data: TSMC stated that the exposed information was unrelated to company operations or customer-related information.
- Employee notification: The company is informing affected personnel and providing necessary support.
- Ongoing investigation: TSMC is working with the cloud service provider, investigating authorities and a third-party cybersecurity agency to establish the facts and take appropriate action.
TSMC has not publicly identified the cloud service provider involved or disclosed the exact number of affected employees.
Hackers Demand 3 Bitcoin for Allegedly Stolen TSMC Employee Records
According to media reports, threat actors advertised the alleged TSMC employee database on underground cybercrime forums.
The sellers reportedly demanded 3 Bitcoin (BTC) for the data, worth approximately $220,000 or nearly ₹2.07 crore at the time of reporting.
They also allegedly issued a one-week deadline, warning that the complete dataset could be released publicly if no buyer was found.
The reported claims include:
| Detail | Reported claim |
|---|---|
| Alleged records | Approximately 46,000 |
| Dataset size | Around 6.9 GB |
| Asking price | 3 BTC |
| Approximate USD value | $220,000 |
| Approximate INR value | ₹2.07 crore |
| Reported forums | DarkForums and BreachForums |
| Threatened release deadline | One week |
These figures are based on claims attributed to the sellers and media reports. TSMC has not independently confirmed them.
What Information Was Reportedly Exposed?
To support their claims, the hackers reportedly released a sample file named tsmc.txt.
According to media reports, the sample contained 499 records, with 19 information fields in each entry.
The reported information included:
- Employee names
- National identification numbers
- Home addresses
- Phone numbers
- Email addresses
- Banking details
- Job titles
- Emergency contact information
- Dates of birth
- Nationality
The alleged sample reportedly contained 19 fields in total. However, the complete list of fields and the authenticity of the advertised dataset have not been independently verified by TSMC.
If genuine, exposure of this type of personal information could increase the risk of identity misuse, targeted phishing and social engineering attacks against affected individuals.
Was TSMC’s Internal Network Hacked?
Based on the company’s official November 12 statement, TSMC has found no evidence that its own systems were compromised.
The company said the exposed information matched data stored in the system services of a cloud service provider.
This distinction is important because unauthorized exposure of information associated with an external cloud service does not automatically mean that an organization’s internal network has been breached.
TSMC also clarified that the exposed information was unrelated to its company operations and customer-related information.
The company has not publicly disclosed the cloud provider’s identity, the exact technical cause of the exposure or the method through which the information became available externally.
What Was Not Reported as Affected?
According to TSMC’s official disclosure, the exposed employee information was unrelated to:
- Semiconductor production operations
- Company operational data
- Customer-related information
The company also stated that it had found no evidence of compromise to its own systems.
TSMC did not report exposure of chip designs, manufacturing processes or customer databases in its official statement.
These details reflect the company’s public disclosure as of November 13, 2026.
TSMC’s Response and Ongoing Investigation
TSMC stated that it is taking steps to investigate the incident and support affected employees.
The company’s response includes:
- Informing affected current and former employees.
- Providing necessary support to impacted personnel.
- Working with the relevant cloud service provider.
- Cooperating with investigating authorities.
- Engaging a third-party cybersecurity agency to establish the facts.
- Taking appropriate action based on the investigation.
The identity of the cloud service provider and the technical cause of the exposure have not yet been publicly disclosed.
Why the TSMC Incident Highlights Third-Party Cloud Security Risks
The TSMC incident highlights an important cybersecurity challenge: organizations often depend on external cloud providers and technology vendors to store or process sensitive information.
Even when an organization finds no evidence of compromise to its own systems, information held by an external service provider may still be exposed without authorization.
This makes third-party security an important part of an organization’s overall cybersecurity strategy.
Organizations should pay attention to the following areas:
1. Third-Party Security Assessments
Organizations should regularly assess the security practices of vendors and cloud providers that handle employee or business information.
2. Data Access Controls
Access to sensitive employee information should be restricted according to business requirements, with unnecessary access removed.
3. Data Minimization
Organizations should avoid collecting or storing unnecessary personal information across external services.
4. Vendor Security Monitoring
Third-party service providers should be regularly reviewed for security controls, compliance and data protection practices.
5. Incident Response Coordination
Organizations should establish clear procedures with vendors for reporting, investigating and responding to data exposure incidents.
6. Employee Privacy Protection
Personal information should be protected throughout its lifecycle, including when it is stored or processed by external providers.ors that handle its data.
Frequently Asked Questions (FAQs)
Was TSMC hacked in November 2026?
TSMC confirmed unauthorized exposure of some current and former employee information. However, the company stated that it had found no evidence that its own systems were compromised.
How many TSMC employee records were allegedly leaked?
The seller reportedly claimed to possess approximately 46,000 employee records. TSMC has not officially confirmed this number.
What data was reportedly included in the TSMC leak?
A reported sample file allegedly contained employee names, identification numbers, addresses, phone numbers, email addresses, banking information, job titles and emergency contact details. The authenticity and completeness of these fields have not been independently verified.
Was TSMC’s production or customer data affected?
TSMC stated that the exposed information was unrelated to its company operations and customer-related data. The company did not report exposure of production or customer information in its official statement.
Which cloud service provider was involved in the TSMC data leak?
TSMC has not publicly identified the cloud service provider. The company only confirmed that the exposed information matched data stored in a cloud service provider’s system services.