TSMC confirms employee personal data leaked via cloud provider

TSMC confirmed that personal data for some current and former employees showed up without permission on a site outside the company, after the exposed data corresponded to records held by a cloud provider the company uses. The company said its internal systems were not compromised and that manufacturing operations and customer information were not affected. TSMC lodged a Form 6-K at the U.S. Securities and Exchange Commission on Thursday, Nov. 12, 2026, and chief financial officer Wendell Huang signed the filing.

The company said, “TSMC has found that some of our current and former employee data was made available on an external website without authorization.” The actor SmithBianl put a sample text file on a hacking forum on Nov. 8 and said it came from a 6.9 GB collection of 46,000 employee records, offering the data for auction starting at 3 BTC. TSMC has not confirmed the figure of exactly 46,000 affected employees and said only that exposure covered data for some current and former employees. The sample file, tsmc.txt, contained 499 entries across 19 fields, while sellers described fields including emergency contacts, bank details, e-mail, phone numbers, addresses, national ID numbers, nationality, job titles, birthdates and names.

The company did not say whether it reached out to the actor or planned payment to prevent a full public release, and TSMC also did not reply to questions about the forum post details. Bitcoin movements are recorded on a public ledger, so any payment to the sellers would leave a visible trace.

Taiwan’s Personal Data Protection Act treats a contractor that processes personal data for a company as the commissioning agency, so outsourcing that work does not transfer responsibility. Under Article 29, an organization must show a lack of intent or negligence; where losses are unproven, courts may award between NT$500 and NT$20,000 per person per incident, capped at NT$200 million per event. Separate rules let qualifying public interest organizations bring group actions.

Vendor-linked incidents have struck Taiwan, including about 120,000 resumes read without authorization at 104 Job Bank on Oct. 6. An unpatched Appsmith flaw exposed order details for 1,329 brands and roughly 4.79 million consumers at 91APP on Oct. 16. E.Sun Bank saw 418 accounts drained of NT$41.76 million on Nov. 3 via an external supplier’s banking system, and ezTravel exposed data on more than 690,000 people on Nov. 9. TSMC is the fifth such incident in five weeks.

Outside Taiwan, Coinbase said it suffered no direct breach, but an analytics vendor exposed customer information on Nov. 3. DriveWealth said a social engineering campaign lay behind a Revolut customer data breach, and Gnosis Pay revealed a breach hitting its own customers on Nov. 7.

TSMC ranks as the world’s largest contract chipmaker, producing advanced semiconductors for customers such as Apple, Nvidia, Broadcom and Qualcomm. It accounts for roughly 90 percent of the most advanced chips worldwide. The company shipped about 15 million 12-inch-equivalent wafers and recorded $122.4 billion in annual revenue, and its semiconductor market share sits above 70 percent.

A 2023 ransomware case involving IT hardware supplier Kinmax Technology is among several cyber attacks TSMC has faced. LockBit demanded $70 million from TSMC in 2023 after claiming a hack, though TSMC said IT supplier Kinmax Technology experienced a cybersecurity incident that exposed server setup and configuration details. It also dismissed two workers accused of stealing trade secrets.

TSM shares fell 4.90 percent in Thursday’s premarket alongside a broad semiconductor selloff, after closing Wednesday at $413.35. Revenue for October totaled NT$586.89 billion, up 59.7 percent from the prior year. Shares have gained 32.49 percent and are down 8.86 percent over a month, leaving a $1.89 trillion market cap.

The reporting attributes the premarket decline mainly to the Nvidia selloff rather than the leak, and fourth-quarter results are due around Jan. 21. Revenue from January through October totaled NT$4,485.62 billion, up 43.3 percent, and the trailing price-to-earnings ratio is 25.52.

The company is notifying affected employees, offering help, and working with the cloud provider, investigating authorities and an external cybersecurity firm. Chief Financial Officer Wendell Huang said, “We have been informing impacted personnel and are providing them with necessary support.” Huang said TSMC is engaging the cloud vendor, authorities and an external cybersecurity agency to determine facts and take action. TSMC has not identified the cloud provider or described how the records exited that provider’s system, and TSMC has announced no compensation plan for affected individuals.