Abstract:
TSMC, the world's largest foundry company, recently confirmed that the personal information of some current and former employees appeared on external websites without authorization. TSMC stated that a preliminary investigation found no evidence that the company's own information system had been compromised. The data involved was consistent with information stored in a third-party cloud service provider's system, but did not involve TSMC's production operations, business secrets, or customer-related data.
TSMC submitted a 6-K document to the U.S. Securities and Exchange Commission (SEC) on November 12, officially disclosing the leak of employee personal information. The company said it had confirmed that some employee personal data had been posted to an external website without authorization. Information currently available shows that the information matches data stored in the system services of a cloud service provider.
TSMC emphasized that there is currently no evidence that the company's internal systems have been compromised, and no production operation information or customer data has been found to be involved in this incident. The company is notifying current and former affected employees and providing them with necessary support. At the same time, TSMC has cooperated with relevant cloud service providers, investigation agencies and third-party network security agencies to find out the specific incident and take corresponding measures.
It is worth noting that TSMC did not disclose the name of the cloud service provider involved, nor did it disclose how many employees were affected and what types of personal information were involved.
Relevant clues about this incident have appeared on cybercrime forums before. According to cybersecurity media, on November 8, an unidentified cybercriminal posted news of selling TSMC employee data on an underground forum. He claimed to have approximately 46,000 employee records, with a total data volume of 6.9GB, and asked the buyer to pay 3 Bitcoins, which was approximately US$200,000 at the time. The publisher also threatened to disclose all data if no one buys within a week.
According to Taiwanese media reports, some data samples displayed on relevant forums are said to contain sensitive information such as employee names, ID numbers, and bank account information. However, these contents are still unilateral statements made by cyber criminals. TSMC has not officially confirmed the amount of leaked data, file size and specific information categories, nor has it confirmed that the data sold on the forum exactly corresponds to the incident disclosed by the company.
Judging from the regulatory documents submitted by TSMC, the company is currently focusing its investigation on the data security issues of third-party cloud service providers. Since the relevant information matches the data stored in the cloud service provider's system, investigators need to further confirm whether the data was stolen within the cloud service provider or leaked through other systems or channels that can access the same information.
This also means that although TSMC has not found that its own internal network has been compromised, it cannot rule out the possibility that its employees' personal information was leaked through external service providers. For large multinational companies, human resources, payroll management, employee identity verification and other administrative services often need to rely on external cloud platforms. Once there are loopholes in the security measures of third-party service providers, the company itself may face serious data leakage risks even if it is not directly attacked.
TSMC has been attaching great importance to network security issues in recent years. In 2023, the company suffered a ransomware attack related to a supplier. At that time, the cybercriminal organization LockBit claimed to have obtained data related to TSMC's supply chain and tried to force related companies to pay ransom through extortion. TSMC later stated that the incident stemmed from an attack on Kinmax Technology, an IT hardware supplier, and emphasized that its production system was not affected.
In addition, TSMC fired two employees in 2025 who were suspected of stealing and trying to leak advanced process technology secrets. Related incidents further highlighted the complex security challenges faced by the semiconductor industry in terms of internal information management and technology confidentiality.
As one of the world's most important semiconductor manufacturers, TSMC provides chip manufacturing services to many technology companies such as Nvidia, Apple, AMD, Qualcomm and Broadcom. Its advanced process technology and production operation data have extremely high commercial value, so the outside world has always paid close attention to the company's network security system.
However, this incident and the intrusion of the production system are two different levels of problems. According to the information currently released by TSMC, what is affected is the personal data of some employees, not chip design, customer orders, manufacturing processes or fab production data. The company has found no evidence that customer information has been affected.
This incident once again demonstrates that even global technology giants with extremely high security protection capabilities cannot completely escape the cybersecurity risks posed by third-party supply chains. An enterprise's data security boundary is no longer limited to its own servers and internal networks. Outsourcing service providers, cloud platforms, and various collaboration systems may also become targets for attackers looking for breakthroughs.
Currently, TSMC has not announced the identity of the cloud service provider involved, nor has it disclosed the final number of affected employees. As the company continues to investigate with law enforcement agencies and third-party cybersecurity teams, the specific source of the data breach, the scope of its spread and whether other sensitive information was involved remain to be further confirmed.
Comments