Taiwan Semiconductor Manufacturing Company (TSMC) confirmed that personal employee data has been leaked online after a threat actor put 6.9GB of information allegedly stolen from the company up for auction.
The technology giant said the incident affected current and former employees but doesn’t impact its operations or customers.
The company verified the leaked information and confirmed that it matched “data stored in the system services of a cloud service provider,” indicating an external breach.
TSMC is the world’s largest contract chipmaker, manufacturing advanced processors and other semiconductors for companies such as Apple and Nvidia.
Last year, it shipped approximately 15 million 12-inch-equivalent wafers and generated $122.4 billion in annual revenue.
TSMC’s investigation found that the leaked information matched data stored in a cloud service provider it uses, pointing to a breach outside its own infrastructure.
The company is now notifying impacted staff and providing the necessary support, while also engaging a third-party cybersecurity firm to help manage the situation.
“TSMC has found that some of our current and former employee data was made available on an external website without authorization,” TSMC says in a filing with the Securities and Exchange Commission (SEC).
“Currently, we have found no evidence that TSMC’s systems have been compromised,” the company added.
Threat actor auctions the data
On November 8, someone using the alias ‘SmithBianl’ leaked on a hacker forum a text file containing 499 rows of information allegedly stolen from TSMC. The actor claimed the file was a sample of a 6.9GB dataset containing 46,000 employee records.
According to the post, the leaked information included TSMC employees’ national ID numbers, addresses, contact details, and banking information.
SmithBianl offered the data for auction, with bidding starting at 3 BTC (approximately $65,000).
In the absence of a buyer, they warned that the data would be leaked for free in one week, setting the first deadline to November 15.
BleepingComputer has contacted TSMC to ask whether they have engaged with the threat actor and whether they planned to pay the hackers to prevent a full public leak of their employees’ data.
A spokesperson declined to comment at this stage.
Adaptive Security’s AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
See what’s getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Start your free email security scan.
