TSMC has confirmed that personal data belonging to some current and former employees was posted online without authorisation, after an unidentified seller offered what it claimed was 6.9GB of TSMC employee data — about 46,000 records — for 3 bitcoin. The chipmaker says there is currently no evidence that its own systems were breached, and that early checks point to a cloud service provider it works with.

The listing appeared on underground forums on 12 November 2026, according to reports citing Taiwan's Central News Agency. TSMC said it activated its incident response process as soon as it learned the information had been posted, and it is now working with the cloud provider, law enforcement and third-party cybersecurity firms. The company has not confirmed how many people are affected, or named the provider involved.

What the seller claimed

Reports say the seller posted on forums including DarkForums and BreachForums, claiming to hold 46,000 TSMC employee records totalling 6.9GB. The asking price was 3 bitcoin, worth about NT$7.4 million, or roughly $220,000, with a threat to publish the full set if no buyer came forward within a week.

To support the claim, the seller released a sample file called "tsmc.txt", reported to contain 499 records with 19 fields each. Reports say the fields in the sample include names, dates of birth, job titles, nationalities, national ID numbers, addresses, mobile phone numbers, email addresses and bank account details, as well as emergency contacts' phone numbers and addresses. Whether all 46,000 records claimed by the seller are genuine, and how complete the data is, remains to be verified.

That distinction matters. A seller's claim about the size of a stolen dataset is not proof of its size, and the sample alone does not show how many of the claimed records are real, current or complete. What is confirmed is TSMC's own statement that some current and former employees' information was posted without authorisation.

What TSMC has confirmed

TSMC said that, as of now, there is no evidence that its internal IT systems or wafer manufacturing equipment were compromised. Its preliminary comparison of the leaked material indicated that it matches data held in the systems of a cooperating cloud service provider, rather than data taken directly from TSMC's own systems.

The company also said the leaked material does not involve its chip manufacturing operations or customer-related information. It said it has begun providing support to affected employees and is working with the provider, the investigating authorities and third-party cybersecurity firms to clarify what happened.

Taiwan's Ministry of Digital Affairs said it was aware of the situation and is helping businesses strengthen cybersecurity and personal-data protection. The ministry also reminded companies that, once a personal-data breach occurs, they should report it to the competent authority, notify the people affected and identify the cause within 72 hours.

What is still not known

TSMC has not yet disclosed the number of people affected or the name of the cloud service provider, and the investigation has not yet established how the data was obtained or where responsibility lies. Those questions will decide whether this was a failure at one supplier, a wider weakness in how employee data is shared with outside vendors, or something else entirely.

Until those answers are available, employees and former employees whose details may be involved should be alert to phishing messages, calls or emails that use personal details to appear genuine, and to any unexpected use of their identity or bank details. Anyone contacted about the leak should check through TSMC's own channels rather than trusting an unsolicited message.

Why a supplier leak matters

The incident is a reminder that a company's security is only as strong as the weakest supplier that holds its data. TSMC's chip factories are protected by strict separation between manufacturing systems and office networks, and there is no evidence that production or customer data was touched. But employee records held by an outside provider still carry names, identity numbers, addresses and bank details — information that can be used for identity theft and financial fraud, and for targeted attacks against the people concerned.

For other large employers, the lesson is to check which outside suppliers hold staff data, what access they have, and whether their security standards match the company's own. For TSMC, the next test is whether it names the provider, confirms the true scale of the leak and explains what will change in how it oversees suppliers.

Source: BigGo Finance, reporting TSMC's statement and Taiwan's Central News Agency. Further reporting: TechFlowPost.