Newshot TSMC Confirms Data Breach, Employee Information Leaked via Third-Party Cloud Provider
TSMC Confirms Employee Data Leak, Source Traced to Third-Party Cloud Provider
TSMC confirmed that personal data of some current and former employees was published unauthorized on the public internet.
TSMC disclosed the incident on November 12, 2026, stating that the leaked information fully matched records stored by an external cloud service provider, and that there is currently no evidence that attackers breached the company’s own systems.
The leak involves only employee-related information and does not include chip production data or customer records. The official statement has not yet addressed several core questions: how attackers obtained the data, the specific identity of the cloud service provider involved, and the total number of affected employees.
6.9GB of Data Reportedly Listed for Sale, Containing Multiple Sensitive Personal Information Items
According to Taiwan English-language news reports, an anonymous seller listed 46,000 TSMC employee records for sale on DarkForums and BreachForums, asking for 3 bitcoins and threatening to release the entire dataset if no buyer emerged within a week. The authenticity of the sale information has not yet been verified.
Related rumors say the dataset listed for sale totals 6.9GB, and the disclosed sample data includes employee names, ID numbers, and bank account information.
TSMC has not publicly confirmed the full scope of leaked fields. The public should note the distinction between sample information circulating on forums, rumor content, and conclusions verified by TSMC officially.
Such combined sensitive personal information may pose long-term risks to affected employees. Attackers can use this batch of names, identity information, and bank account details to impersonate payroll department employees, bank staff, or customer service personnel. The scam messages they send are highly deceptive, and ordinary users may find it difficult to identify them accurately. However, there is currently no public evidence that this stolen information has been used to carry out scams.
Intrusion Path Still Unclear, TSMC Conducts Investigation with Multiple Parties
In a regulatory filing submitted on November 12, TSMC mentioned that the company had completed comparison and verification of the leaked information against data stored by the cloud service provider. This result only proves that the leaked records are related to third-party cloud services and cannot explain the specific method by which attackers obtained the data.
Officials have not yet disclosed the intrusion entry point, the type of malware involved, the vulnerabilities exploited, or stolen account information in this incident. The claim that “attackers directly breached TSMC’s internal network” is not supported by any evidence. The identity of the cloud service provider involved and the specific type of services it provided to TSMC have also not been made public.
This incident once again draws public attention back to cloud access control issues. Cybersecurity News previously reported on UNC5537’s attack campaign against Snowflake customer accounts, in which attackers used stolen credentials and gaps in multi-factor authentication protection to steal data. That attack campaign is an independent incident and is unrelated to this TSMC data breach.
The media outlet’s previously reported suspected arrest of Snowflake hackers also shows that cloud data theft often involves multiple affected enterprises and triggers cross-entity investigations. There is currently no evidence that these cases are connected to this TSMC data breach.
TSMC is currently notifying affected employees one by one and providing supporting assistance. The company is working with the cloud service provider involved, law enforcement investigation departments, and third-party cybersecurity agencies to conduct a traceability investigation, verify the full picture of the incident, and take response measures.
As of now, the confirmed scope of the incident is only the leak of employee information related to third-party storage records. The investigation team still needs to determine the specific path by which this data flowed out of the third-party cloud environment and the final total number of affected individuals.
TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider