TSMC reports outside breach exposing 46,000 employee records

Taiwan Semiconductor Manufacturing Co. confirmed in a regulatory filing on Nov. 13, 2026, that unauthorized parties posted personal data belonging to current and former employees online.

The disclosure followed underground forum listings where an extortionist offered 46,000 personnel files totaling 6.9 gigabytes for 3 bitcoin, or approximately $220,000.

The claimed dataset represents roughly 60% of TSMC's 76,000-person global workforce, marking an extensive exposure of staff identity records across its semiconductor operations.

TSMC filed a Form 6-K report with the U.S. Securities and Exchange Commission, signed by Senior Vice President and Chief Financial Officer Wendell Huang.

Internal company networks suffered no direct intrusion, and the incident caused no interruption to daily chip production schedules, the foundry said in the filing.

The compromised information matched records stored in the infrastructure of an outside cloud service provider rather than proprietary foundry databases, the company said.

The incident did not expose wafer fabrication recipes, lithography tooling calibrations, or proprietary integrated circuit designs submitted by foundry customers, TSMC said.

Threat actors listed the database across darknet marketplaces, including DarkForums and BreachForums, releasing a sample archive to validate their financial extortion demands, cybersecurity researchers said.

The proof file distributed on dark web forums held 499 individual personnel profiles structured across 19 distinct data fields, cybersecurity analysts said.

Exposed attributes include legal names, birth dates, home addresses, mobile phone numbers, email addresses, national identification numbers, bank account details, and emergency contacts.

The exposure of personal identifiers creates severe social engineering vulnerabilities for fabrication engineers holding access credentials to sensitive cleanroom environments, security specialists said.

Adversaries frequently use compromised banking and residency data to execute targeted spear-phishing campaigns against senior hardware engineers, threat intelligence researchers said.

Rival manufacturers and state-sponsored espionage groups actively target foundry personnel who possess technical expertise in 2-nanometer and 3-nanometer gate-all-around fabrication architectures, analysts said.

Contact directories and emergency contact listings provide threat actors with secondary vectors to pressure engineering staff through family members or financial impersonation, cybersecurity investigators said.

The incident marks the second significant contractor-related security breach to touch TSMC's supplier network over the past three operating years.

The LockBit ransomware syndicate compromised IT hardware provider Kinmax Technology in June 2023, demanding $70 million after extracting server configuration scripts.

TSMC severed all data transmission lines with Kinmax immediately following that attack, demonstrating its policy of isolating breached peripheral suppliers.

Third-party vendors represent the soft underbelly of semiconductor security because contractors often maintain weaker authentication protocols than primary foundries, industry analysts said.

Top fabless customers, including Apple and Nvidia, contractually require foundries to enforce strict physical and digital controls to safeguard tape-out intellectual property.

Foundry customers routinely conduct annual security audits covering intellectual property partition walls, server air gaps, and cleanroom encryption architectures, semiconductor analysts said.

The exposure of human resource data is expected to prompt fabless design teams to demand expanded third-party vendor audits that extend beyond wafer manufacturing cleanrooms.

TSMC said it began issuing notifications to affected current and former employees, offering security guidance to mitigate identity theft and unauthorized financial transactions.

The chipmaker opened a joint technical inquiry alongside the unnamed cloud vendor, local law enforcement bodies, and an external cybersecurity agency, TSMC said.

The Form 6-K filing does not name the cloud service provider, confirm the seller's claim of 46,000 records, or detail the vulnerability exploited.

The forum seller set an auction deadline of Nov. 19, 2026, threatening to release the entire 6.9-gigabyte personnel database if no buyer pays the 3-bitcoin asking price.