TSMC has confirmed that personal data belonging to some of its current and former employees was posted on an external website without authorisation, after a seller began offering what it claims are about 46,000 employee records. In a statement filed with the US Securities and Exchange Commission on 12 November, the world’s largest contract chipmaker said it had “found no evidence that TSMC’s systems have been compromised”. It said the leaked information matched data stored in the system services of a third-party cloud provider, and was unrelated to its operations or to customer data. TSMC has not named the provider, however, and has not said how many people are affected.
The listing appeared on two underground forums, DarkForums and BreachForums, according to United Daily News and ETtoday. The seller is asking for 3 bitcoin, or about NT$7.4 million, for a 6.9GB data set, and has threatened to publish everything if no buyer comes forward within a week. A sample file of 499 records, each with 19 fields, was posted alongside the listing, United Daily News reported. Neither TSMC nor Taiwanese media have verified that the full set holds 46,000 records.
The listing includes national ID numbers and bank details
According to the seller’s listing, as described in Taiwanese reports, each record includes a name, date of birth, job title, nationality, national ID number, home address, mobile number and email address. Some records reportedly also contain bank account information, along with the phone numbers and addresses of employees’ emergency contacts. TSMC’s own statement does not list the fields involved, although it says the company is informing affected staff and providing them with support. A national ID number combined with a bank account and a home address is enough for convincing impersonation attempts against banks and mobile operators. That is why the exposure matters even without a breach of TSMC’s network.
The profile of the people involved also makes the data unusually valuable. TSMC’s engineers are among the most sought-after in the chip industry, and job titles tied to names and phone numbers are useful material for targeted phishing and recruitment approaches. Taiwanese prosecutors charged several people in 2025 over the alleged theft of trade secrets linked to TSMC’s 2nm process, a case that showed how much outsiders will invest to reach the company’s staff. TSMC said it is working with the cloud vendor, the relevant investigating authorities and a third-party cybersecurity firm to establish the facts.
TSMC says chip production and customer data are not affected
For gamers and the wider hardware market, TSMC’s key claim is that the incident does not touch its fabs. The company makes most of the world’s most advanced chips, including Nvidia’s GeForce and data centre GPUs and AMD’s Ryzen and Radeon processors. It also builds Apple’s A and M series chips and the custom processors inside the PlayStation 5 and Xbox Series consoles. TSMC said the data is unrelated to its operations, and Taiwanese reports said there was no evidence that wafer production or customer orders were affected. So far, there is no sign of any knock-on effect on the supply of PC or console hardware, which is already under pressure from rising memory costs.
TSMC has dealt with security incidents before, although the earlier ones followed a different pattern. In August 2018, a virus spread through several of its fabs after what the company called “misoperation during the software installation process for a new tool”. TSMC estimated the impact at about 3% of its third-quarter revenue. In 2023, the LockBit ransomware group claimed to have hacked TSMC, but the company said the incident hit a hardware supplier and exposed only server set-up information. The latest case again points to a third party, this time a cloud provider holding employee records.
Gaming companies have faced the same problem with outside vendors this year. Valve warned some European hardware buyers after a breach at a logistics partner, and last year’s Discord leak exposed tens of thousands of ID photos held by a support contractor. In each case the entry point sat outside the company’s own systems, while its users or staff carried the risk.
The next test comes if the seller follows through on its one-week deadline. A public release would put the full data set within reach of anyone, rather than a single buyer, and would show whether the 46,000 figure is accurate. TSMC has not said when it learned of the exposure, which cloud provider was involved, or whether that provider’s other clients are affected. TSMC and its subsidiaries employed more than 90,000 people at the end of 2025, according to its annual report.
