TSMC Confirms Employee Data Exposure Linked to Cloud Service Provider, Says Internal Systems Were Not Compromised
Taiwan Semiconductor Manufacturing Company, better known as TSMC, has confirmed that some current and former employee data was exposed online without authorization. The company says the incident did not involve a breach of its internal systems, production operations, or customer-related information.
The issue came to light after hackers claimed on underground forums that they had obtained TSMC-related data. According to reports, the stolen files total around 6.9GB and may include records connected to roughly 46,000 employees. The attackers are reportedly demanding three Bitcoins as ransom and have threatened to release the information publicly if payment is not made.
To support their claims, the hackers allegedly shared a sample file named “tsmc.txt,” containing details of 499 employees. The exposed information reportedly includes addresses, bank account numbers, and emergency contact details. Such data can be highly sensitive because it may be used in phishing campaigns, identity theft, financial fraud, or impersonation attempts targeting employees.
TSMC, the world’s largest and most advanced contract chip manufacturer, is a major target for cybercriminals due to its critical role in the global semiconductor supply chain. The company produces advanced chips for many of the world’s leading technology firms and plays a key role in next-generation chipmaking, including advanced process nodes and packaging technologies.
However, TSMC stressed that the exposed data appears to have come from a cloud service provider rather than from its own systems. The company said it found no evidence that its corporate networks, manufacturing operations, trade secrets, or customer data were compromised.
In its response, TSMC said the leaked information matches data stored in services operated by a cloud vendor. The company also stated that the incident is unrelated to its business operations or customer information. TSMC is now notifying affected individuals and providing necessary support.
The chipmaker added that it is working with the cloud service provider, relevant authorities, and a third-party cybersecurity firm to investigate the incident and take appropriate action. TSMC also reaffirmed its commitment to protecting employee privacy and strengthening data security.
The incident highlights a growing cybersecurity challenge for major technology and semiconductor companies: even when internal systems remain secure, third-party vendors can still become weak points in the data protection chain. Cloud platforms, hardware suppliers, software providers, and outsourcing partners often store or process sensitive information, making them attractive targets for ransomware groups and data thieves.
For TSMC, protecting employee information is especially important. Semiconductor engineers and technical staff are highly valuable in a competitive global chip industry. Employee data can be used not only for identity theft, but also for targeted social engineering attacks aimed at gaining access to confidential information or recruiting talent.
This is not the first time TSMC’s supplier ecosystem has faced a cybersecurity issue. In 2023, a hardware supplier connected to the company was targeted by a ransomware group that demanded a large payment. While that case also did not directly compromise TSMC’s core systems, it underscored the risks facing companies at the center of the global chip supply chain.
TSMC remains one of the most important companies in the semiconductor industry, with leadership in advanced manufacturing, research, and chip packaging. Its technologies are essential for smartphones, artificial intelligence processors, high-performance computing, automotive chips, and data center hardware.
The latest employee data exposure does not appear to affect TSMC’s manufacturing output or customer operations. Still, the incident serves as a reminder that cybersecurity in the semiconductor sector extends far beyond factory networks and chip designs. It also includes employee records, vendor platforms, cloud services, and every digital system connected to a company’s broader operations.
TSMC said it will continue working with investigators and cybersecurity specialists to determine the full scope of the breach and protect affected personnel. The company emphasized that safeguarding employee privacy and maintaining data security remain top priorities.
