A major data breach at Taiwan Semiconductor Manufacturing Company (TSMC) has led to the personal details of around 46,000 employees being advertised for sale by cybercriminals, who are demanding payment in Bitcoin. TSMC, the world’s largest semiconductor foundry, confirmed the incident on Thursday, stating that its internal systems remain uncompromised and that the breach originated from an external supplier.
Sale of employee data on underground forums
Hackers have posted nearly 7GB of data, alleged to contain the personal information of TSMC staff members, on the underground forums DarkForums and BreachForums. The sellers are asking for almost 3 BTC, equating to about NT$7.4 million or $220,000, and have set a one-week auction deadline. They warned that if negotiations fail, they may release the compromised data publicly at no cost.
The dataset reportedly includes the names and contact information of both current and former TSMC employees, although company representatives have not confirmed the exact number of people affected.
TSMC response and investigation
TSMC has clarified that it does not believe its own networks were directly compromised. In its statement, the company identified an outside service provider as the likely source of the breach, noting that the exposed records appear to correspond with those held by this vendor’s cloud system.
TSMC, along with the unnamed vendor and external cybersecurity experts, has initiated a comprehensive investigation to determine the breach’s root cause and to prevent further incidents. The firm has also begun notifying employees whose information was exposed.
TSMC is a leading manufacturer supplying chips for major global technology firms. In its most recent quarterly report, the company posted a net profit of NT$763.064 billion (US$22.89 billion), driven by the high demand for advanced semiconductor nodes.
Mini dictionary: TSMC (Taiwan Semiconductor Manufacturing Company) is the world’s largest contract manufacturer of semiconductor chips, supplying processors and integrated circuits to top technology companies globally.
Nature of leaked data and potential risks
To verify their claims, the hackers released a sample database file named “tsmc.txt” containing 499 employee records, each with 19 distinct data fields. The compromised data reportedly includes names, dates of birth, job titles, nationalities, national ID numbers, home addresses, mobile numbers, and email addresses. In addition, leaked bank account details have revealed emergency contact information for employees, exposing additional names, phone numbers, and locations.
Security analysts warn that such comprehensive information may be exploited in phishing attempts, social engineering, and even talent recruitment by rival firms. The inclusion of organizational charts further increases these risks.
Security experts highlight that the multi-layered information exposed can serve as a resource for cybercriminals seeking to target affected employees, not only for financial schemes but also for phishing and identity theft campaigns.
This breach follows a recent pattern of cyberattacks targeting Taiwanese companies, with organizations such as job bank 104, e-commerce platform 91APP, SinoPac Bank, and travel site eztravel falling victim to similar third-party data incidents.
| Company | Incident Type | Data Exposed |
|---|---|---|
| TSMC | Employee data breach | 46,000 records |
| Job bank 104 | Third-party data breach | User information |
| 91APP | Data breach | Undisclosed |
| SinoPac Bank | Fund drains/data breach | Financial, user data |
| eztravel | Data breach | User information |
Previous cyberattacks on TSMC
This is not the first time TSMC has faced a significant security issue. In June 2023, the LockBit ransomware syndicate demanded $70 million from the company after it was listed on LockBit’s leak platform. The breach then was traced back to Kinmax Technology, a hardware supplier whose testing environment inadvertently exposed server configuration files.
Cybersecurity firm Bitdefender reported that LockBit subsequently lowered its ransom demand upon realizing that its attack did not directly affect TSMC’s internal infrastructure. TSMC responded by severing data exchange with Kinmax and confirmed that customer data was never compromised in this incident.
TSMC emphasized that, under Taiwan’s Personal Data Protection Act, companies outsourcing data management remain liable for breaches, and affected individuals are eligible for compensation of NT$500 to NT$20,000 each, with a maximum liability of NT$200 million per incident.
