TSMC Confirms Leak of 46,000 Employee Records After 6.9GB Data Sale Offer

Taiwan Semiconductor Manufacturing Company produces roughly 90 percent of the world's most advanced chips, a position that makes its factories, its roadmaps and its payroll a permanent target for criminals and intelligence services. Its employee roster is not a trade secret in the ordinary sense, but it works like a map: it names the engineers who tune leading edge processes and the people whose bank accounts can be reached with the right identifiers.

On 12 November 2026, TSMC filed a Form 6-K with the US Securities and Exchange Commission confirming that some current and former employee data had appeared on an external website without authorization. The filing said it had found no evidence that TSMC's systems were compromised, and that the information had been verified to match records stored in the system services of a cloud service provider. The provider was not named, the service was not described, and no number of affected people was given.

The number came from the sellers. Taiwanese media, citing underground forum listings, reported that anonymous vendors offered roughly 46,000 TSMC employee records, a bundle of 6.9 gigabytes, for three Bitcoin. The price was about NT$7.4 million, or around $200,000, and the sellers threatened to publish everything if nobody bought within a week.

The disclosure arrived during a difficult stretch for Taiwanese cybersecurity. Travel booking site EzTravel said on Monday that hackers had exposed data on more than 690,000 customers. Bank SinoPac said on Wednesday that its online banking system had been exploited for unauthorized transfers worth NT$41.76 million. The same day, Taiwan's Ministry of Digital Affairs said 8 million records had leaked from more than 10 companies and government agencies, including the Bureau of Consular Affairs, and warned that AI enabled cyberattacks are an international trend.

Key Facts

Taiwan News reported on November 12 that TSMC confirmed the leak after personal records of current and former staff appeared on external websites, while denying any compromise of its own systems. Citing Business Next, it said samples showed names, national ID numbers and bank account information. TSMC said those affected had been informed and that it was working with the cloud provider, cybersecurity firms and law enforcement to trace the origin.

Cybernews reported on November 13 that the hacker claimed the files totalled 6.9GB and covered around 46,000 employee records, and demanded three Bitcoins, roughly $200,000, to keep them private. The seller posted a sample covering 499 employees, including addresses, bank account numbers and emergency contact details, a combination directly useful for phishing. TSMC stock slipped quickly on Thursday as the news spread, the outlet noted.

The Asia Business Daily reported on November 13 that the seller claimed data in 19 categories, including names, dates of birth, job titles, nationalities, identification numbers, addresses, mobile numbers, email addresses and banking details, plus emergency contacts. Citing local media including the United Daily News, it put the price at about KRW 280 million and noted that the authenticity of the records had not been verified. That distinction matters: 46,000 is the seller's figure, while TSMC has confirmed only that some employee data appeared online.

PC Gamer reported on November 13 that the filing said the data was unrelated to operations or customer related information, and that TSMC had engaged the cloud vendor, investigating authorities and a third party cybersecurity agency. It recalled the 2023 episode in which the LockBit ransomware group tried to extort TSMC for $70 million after a claimed hack, which TSMC denied involved a direct breach, saying supplier Kinmax Technology had suffered an incident that exposed server setup and configuration information.

The exposure also sits inside a broader pattern of identity data leaving Taiwanese institutions. The ministry's tally of 8 million records from more than 10 companies and agencies dwarfs the TSMC archive the sellers described. For a chipmaker of this visibility, a leak of names and bank details carries a commercial edge as well as a criminal one: its engineers are a resource rivals have tried to recruit, and a list of who works where, at what title, with which contact details, is a targeting list. TSMC says client information and production were not involved.

Analysis

What this really means is that the consequential part of this incident is not the fab, it is the identity layer wrapped around it. Nothing disclosed so far suggests an attacker reached process recipes, customer tape outs or production systems, and the filing is explicit that no compromise of TSMC's own systems has been found. What the sellers claim to hold is the raw material of fraud: names, dates of birth, identification numbers, phone numbers and bank accounts, plus emergency contacts that make a pretext call sound convincing. That is a serious problem for 46,000 people even if no wafer was affected.

The company's account is internally consistent, and the detail about matching records held by a cloud provider is the most important line in it. It points to data outside TSMC's own perimeter, in a service run by a vendor the company will not name. That silence is the weakest part of the disclosure. Until the provider is identified, other customers cannot judge whether they share the exposure, and researchers cannot check whether the 6.9GB bundle corresponds to that provider's systems. No evidence of compromise is a statement about an investigation in progress, not a finding that no intrusion occurred.

The sequence is telling. Listings appeared on DarkForums and BreachForums earlier in the week, with a seven day deadline, and the confirmation came on the Thursday. On the public record the sale offer preceded the corporate statement, which suggests the first clear signal came from outside the company rather than from internal detection. That is not proof of a slow response, but regulators and customers will ask about it when they reconstruct the timeline.

The 2023 comparison is instructive. LockBit demanded $70 million then, and TSMC's position was that the intrusion ran through a hardware supplier rather than its own network. Three years later the demand is three Bitcoin and the alleged pathway is a cloud service. Risk keeps arriving through partners, and a supplier's security posture is now part of the chipmaker's attack surface.

Why It Matters

For the individuals on the list, the harm is concrete and likely to outlast the news cycle. A name combined with an identification number, a date of birth, a phone number and a bank account is enough to support convincing fraud, and emergency contact details widen the circle of people who can be manipulated. Unlike a password, a national identification number cannot be reset, so the exposure persists after the listing is removed or the investigation closes.

For TSMC, the reputational stakes are disproportionate to the technical severity. It makes roughly 90 percent of the world's most advanced chips, and its customers include firms whose security teams audit suppliers closely. A leak touching no customer data still invites questions about how employee records are governed when they sit with a vendor, and the unnamed provider makes those questions harder to answer. Cybernews noted the stock slipped quickly on Thursday, a reminder that markets react before they understand the scope.

For Taiwan, the incident is one data point in a much larger problem. A single ministry tally of 8 million leaked records across more than 10 companies and agencies, alongside the EzTravel and Bank SinoPac episodes in the same week, describes a pattern rather than a series of accidents. The Ministry of Digital Affairs has framed AI enabled attacks as an international trend, and this case shows how quickly that trend reaches the country's most important employer.

Next Up

The immediate questions are narrow and testable. Investigators will try to establish whether the 6.9GB archive matches the cloud provider's records, whether the 46,000 figure is accurate, and how the data left the vendor. TSMC says it is working with the provider, cybersecurity firms and law enforcement and has notified affected employees, but it has not committed to naming the provider or to a public timeline. The sellers' one week deadline is the next visible milestone.

Beyond this case, expect pressure to move from disclosure to vendor accountability. If the records came from a cloud service, the incident becomes an argument about contract terms, audit rights and breach notification timelines for every Taiwanese company that keeps employee data with a third party. The ministry has urged caution; the harder question is whether this week's cascading disclosures produce rules, or another round of statements.