Taiwan Semiconductor Manufacturing Company confirmed on November 12 that some current and former employee data was exposed through a third-party cloud service provider, days after a threat actor advertised the files on a dark web forum. TSMC said its own systems were not compromised.
What the Forum Post Claimed and What TSMC Confirmed
Earlier in the week, a threat actor posted on a dark web forum claiming to hold internal TSMC data. The listing described 6.9 GB of material and about 46,000 employee records, and offered a 499-employee sample that included addresses, bank account numbers and emergency contacts. The seller reportedly asked for 3 Bitcoin.
In a filing, TSMC said some current and former employee data “was made available on an external website without authorization.” The company said the data matched information held by a cloud service provider, found no evidence that TSMC’s own systems were compromised, and said the data is unrelated to company operations or customer data.
Why the Seller’s 46,000 Record Figure Is Unverified
The 46,000 number comes from the seller and has not been independently verified; some reports cite 49,000 files instead. TSMC has not given a record count and has not named the vendor involved.
Third-Party Cloud Exposure as the Entry Point
TSMC’s account places the failure outside its own network. The data sat with a cloud service provider, and TSMC said it is working with that vendor, with authorities and with an outside security firm. The company is notifying affected staff. TSMC shares slipped on Thursday after the news.
Risks to Staff Named in the Sample
The sample’s contents carry direct personal risk. Bank account numbers, home addresses and emergency contacts give criminals what they need for targeted phishing, identity theft and payment fraud, and the emergency-contact entries extend the exposure to relatives who never worked for the company.
A Familiar Pattern in Large-Enterprise Breaches
TSMC’s statement follows a structure seen in many third-party incidents: the victim organization says its core systems were not breached, while the exposed data nonetheless reaches the public. The distinction matters for forensics, since it moves the investigation to the vendor’s environment, but it does not change what the exposed employees face.
Employee data held by cloud vendors often sits outside the controls an organization applies to its own infrastructure, and large manufacturers rely on many such providers for services like payroll, benefits and human resources. Each vendor that holds personal records adds another place where a misconfiguration or compromise can surface that data.
The open questions are the ones TSMC has not yet answered: which vendor held the data, how many records were involved, and how the files reached the seller. Until the company or the vendor publishes that detail, the scale of the exposure rests on a criminal’s own listing, and affected staff must treat the forum claim as credible enough to watch for fraud on their accounts.
Open Questions TSMC Has Not Yet Answered
TSMC’s filing describes the data as unrelated to company operations or customer data, which limits the business risk but not the personal one. The company has not said when the cloud provider’s copy of the data was exposed, how the seller obtained it, or whether the vendor has confirmed the match TSMC drew between the leaked files and its records.
The Role of the Outside Security Firm
TSMC said it is working with an outside security firm alongside the cloud vendor and authorities. Those parties will determine whether the 499-record sample reflects the full 6.9 GB the seller advertises. Until then, the seller’s claim of 46,000 employee records and the company’s confirmation of “some” exposed data describe different quantities, and neither side has reconciled them publicly.
