TSMC has confirmed that personal data of some current and former employees was posted on an external website without authorization. The chipmaker disclosed the incident in a Form 6-K filing on November 12, the same day Taiwan's United Daily News reported that someone was selling roughly 46,000 employee records on DarkForums and BreachForums. Apparently, the asking price for the 6.9 GB dump is three bitcoin (about NT$7.4 million), and the seller threatened to publish all of it if no buyer turned up within a week.

A sample file shared with the listing reportedly holds 499 records with 19 fields each, including names, dates of birth, job titles, national ID numbers, home addresses, phone numbers, emails, bank details, and emergency contacts. The 46,000 figure hasn't been verified yet. TSMC says it has found nothing to suggest its own systems were breached. Its initial findings point to a cloud service provider instead, since the leaked data matches records stored with that vendor. The company hasn't named the provider or said how many people are affected.TSMC has dealt with security trouble before. A virus outbreak in 2018 hit a number of its fab tools, and in 2023 the LockBit ransomware gang demanded $70 million after breaching one of its IT hardware suppliers, Kinmax Technology. Three engineers were also indicted last year over stolen 2 nm process files. For the current breach, TSMC claims that no operational or customer data was involved, and that it's working with the vendor, investigators, and an outside security firm.