Data belonging to some current and former employees of Taiwan Semiconductor Manufacturing Company appeared on an external website without authorisation, the company confirmed on 12 November 2026. Forum sellers had put the material up for sale, describing it as 46,000 employee records and asking 3 bitcoin. According to TSMC, the records match data held by a cloud service provider. The company reported no sign of compromise in its own systems, and said neither production nor customer data was affected.
TSMC lodged the confirmation with the US Securities and Exchange Commission as a Form 6-K, signed by chief financial officer Wendell Huang. TSMC is the biggest contract chipmaker in the world. The filing is short. It confirms that the exposure happened and that the data sat outside TSMC's own systems. It gives no scale, names no vendor, and says nothing about how the records left the provider.
How the leak surfaced#
Listings for the dataset appeared on DarkForums and BreachForums, two underground forums. The sellers put the size at about 46,000 TSMC employee records totalling 6.9 GB, and asked 3 bitcoin for the set. ETHNews, reporting Taiwan's Central News Agency carried the claim, and so did Crypto Briefing. At the price on the day of the listing, 3 bitcoin came to about $220,000, or about NT$7.4 million by local media calculation. The sellers threatened to publish the full set within a week if no buyer came forward.
The sellers backed the listing with a sample. A file named "tsmc.txt" held 499 records, each with 19 fields. That sample is all anyone outside the sellers has seen of the claimed dataset, so reporting on the contents depends on it alone. TSMC's reply came the same day, 12 November, in the statement filed to the SEC.
Data reported in the sample#
The sample's contents, as reported, run wide. Reporting on the sample, including FinanceFeeds, describes 19 fields per record: email addresses, national ID numbers, bank details, emergency contacts, home addresses, phone numbers, names, nationalities, dates of birth and job titles. WCCFTech, which also published TSMC's full statement, gives the same list and adds that bank account numbers, emergency contact details and home addresses together hand phishers and impersonators useful material.
TSMC itemised nothing in its statement. The list itself comes from reporting on the sellers' sample, not from the company. Its statement confirms that employee data was posted without authorisation and stops there, leaving the contents undescribed. The 46,000 figure belongs to the sellers, not to the company, and no one has verified whether every claimed record is genuine or how complete the set is. What the sample does establish is narrow: 499 records exist in the form the sellers describe. Nothing in it speaks to the other 45,500.
An email address alone invites spam. Combined with a name, a role, a home address, a national ID number and bank details, it lets a phisher write a message that quotes the recipient's own file back to them. The employer, the job title and the personal details all check out, which is what makes the usual signs of a fake message fail.
What TSMC confirmed and what the sellers claim#
The two versions of events differ on scope, not on the fact of the exposure. The full statement, as published by WCCFTech, reads:
"TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC's systems have been compromised. This information has been verified to match data stored in the system services of a cloud service provider, but is unrelated to the company's operations or customer-related data. We have been informing impacted personnel and are providing them with necessary support. TSMC has engaged with both the cloud service vendor, the relevant investigating authorities, and a third-party cybersecurity agency to jointly ascertain the facts and take necessary actions. We remain firmly committed to protecting employee privacy and safeguarding data security."
What the statement pins down is a short list. Employee data from current and former staff was posted on an external website without authorisation, and the data matches records in a cloud provider's systems. TSMC's own systems show no evidence of compromise. The company is also contacting the people affected, and is working with the vendor, the investigating authorities and a third-party cybersecurity firm.
Everything else comes from the sellers and stays unconfirmed. The claimed size is about 46,000 records and 6.9 GB. The price is 3 bitcoin, the deadline a week, and the field list is the one set out above. TSMC's statement contains none of those figures. It names no cloud provider, explains nothing about how the records left the provider's systems, and leaves the access method undisclosed. Beyond "some" current and former employees, the company has given no victim count.
The headline on the WCCFTech report gives a larger record figure than the report's own body, and larger than every other outlet's figure for the claim. This article sticks to 46,000, and treats it as the sellers' claim in every mention.
Supplier origin#
TSMC's own network was not where the data came from, on the company's account: the records matched data stored in a cloud service provider's systems, which puts the entry point at a supplier. That shape recurred through 2026: the headline names one company, and another company's systems were entered. Crypto Briefing draws the parallel with June 2023, when LockBit's ransomware group listed TSMC as a victim and demanded $70 million, after breaching hardware supplier Kinmax, reaching the chipmaker through a partner once again.
The same shape showed up in AliasFleet's October coverage from Japan. Customer data at Daiwa Securities and at Citizen Watch came out through Scala Communications, a vendor both companies shared, and Sompo Japan reported a breach through that same vendor days later. The firm holding the data was not the firm whose name sat on the customer relationship in any of the three cases. TSMC's case repeats that shape on a bigger scale, and it moves the risk: hardening a company's own network does not stop a vendor it pays from exposing its employees' personal data. Those employees never chose the vendor. They had no way to check its controls either.
What TSMC staff were told to do#
Notification from TSMC itself is the starting point. The company says it is informing impacted personnel and giving them necessary support. A current or former employee should look for that notice first, not for a message found elsewhere. Mail that claims to come from TSMC about the incident needs care: the reported sample hands attackers the details for a convincing fake notice. The order of operations is set out in full in the guide on what to do when an email is in a data breach.
Passwords come first in the response. A TSMC work password used anywhere else should be changed, with the email account at the head of the queue, since every password reset runs through it, and the bank next. The sample lists no passwords, yet the addresses in it are enough to try against passwords from older breaches. That is the live risk from reused passwords, even with no password field in this dump. A password manager speeds the rotation up; the change itself is what matters.
Phishing after this leak needs a different check. The sender now holds the name, the company and the timing of the genuine warning notice, which lets a forgery copy the company's real template, as the guide on how phishing uses a leaked email explains. What still separates a real message from a fake one is the channel, not the content. Links in a breach email should stay unclicked, however genuine they look. The company's site or app should be opened directly and the message checked there; a message that does not appear there did not come from the company.
If bank details were in the data, the response escalates past passwords. The bank's fraud team is the first call, ahead of any guide. It should be asked about monitoring and replacement of the affected account details. In Taiwan, the Joint Credit Information Center offers access to personal credit reports, the local way to check whether an exposed national ID number has been used. The breach notice should be kept somewhere safe, noting the dates, the company name and what was taken, in case a fraudulent account has to be disputed later.
The address problem#
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
What is still unconfirmed#
How serious this turns out to be depends on answers the investigation has not given yet. Scale comes first: are the claimed 46,000 records genuine, and how many current and former employees are actually affected? TSMC has put no number on it, and the sellers' count is unverified, so the vendor question comes next: which cloud provider held the records, and by what mechanism did they leave its systems? Then the deadline: do the sellers publish the full dataset when a week passes with no buyer? Publication would take the data out of a sale listing and into general circulation. Its phishing use would then widen well beyond the sample.
Regulators form a fourth unanswered question. Whether authorities in Taiwan or elsewhere look into the vendor's security controls is something to watch, Crypto Briefing notes. Taiwan's data protection rules cover the employee data at the centre of the incident, and nothing has been said in public about the vendor's obligations under them.
The gap between the two accounts is the limit on this piece. TSMC confirmed an exposure that came from a vendor. The sellers supplied the scale, the size in gigabytes, the field list and the deadline. Those numbers are claims from the sellers or from reporting on their sample, and they stay claims until the company or the investigation confirms a count and a list of data types. The one number that rests on something seen is the 499-record sample. No confirmed misuse of the data has been reported.
