Taiwan Semiconductor Manufacturing Company (TSMC), the world's largest contract chipmaker, has confirmed that personal information belonging to some current and former employees was exposed online without authorization. The incident has raised concerns about employee privacy and third-party cloud security, with hackers reportedly offering a large collection of stolen records for sale.

The attackers claim to possess approximately 46,000 employee records, totaling around 6.9GB of data. They are reportedly demanding three Bitcoin in exchange for the information and have threatened to release the complete dataset if no buyer emerges.

However, TSMC says there is no evidence that its internal systems were compromised. The company also stressed that the exposed information is unrelated to its semiconductor manufacturing operations or customer data.

Hackers Claim to Have Stolen 46,000 Employee Records

The incident came to attention after a threat actor advertised what they described as stolen TSMC employee information on underground cybercrime forums.

According to cybersecurity reports, the attackers claim the dataset contains approximately 46,000 records and occupies around 6.9GB of storage.

The hackers reportedly released a sample containing information associated with 499 employees to demonstrate that they possess genuine records.

The sample allegedly includes sensitive personal details such as names, addresses, identification numbers, banking information and emergency contact details.

The attackers are reportedly asking for three Bitcoin, worth approximately $200,000 to $220,000 depending on market prices, to sell the dataset.

Important: The claimed number of affected employees and the complete contents of the dataset have not been independently confirmed by TSMC.

TSMC Says Its Own Systems Were Not Hacked

In an official statement dated November 12, 2026, TSMC confirmed that some current and former employee information had appeared on an external website without authorization.

The company explained that its investigation found the exposed information matched records stored within a third-party cloud service provider's systems.

TSMC emphasized that it had found no evidence of a compromise involving its own internal systems.

The company also clarified that the exposed information was not connected to its manufacturing operations or customer-related data.

This distinction is important because TSMC manufactures advanced semiconductors for some of the world's biggest technology companies, including Apple, Nvidia and AMD.

How Did the Data Leak Happen?

The exact method used to obtain the information has not yet been publicly established.

TSMC confirmed that the exposed records were associated with an external cloud service provider, suggesting that the incident involved information stored outside its own internal infrastructure.

However, the company has not publicly identified the cloud provider or explained whether the incident involved stolen credentials, unauthorized access or another security weakness.

The investigation is ongoing, with TSMC working alongside the service provider, relevant authorities and an independent cybersecurity organization to determine what happened.

Employees Could Face Identity Theft and Phishing Risks

Although the incident reportedly does not involve customer information or semiconductor production data, the exposure of employee records could still create serious privacy risks.

Personal information such as identification numbers, home addresses, banking details and emergency contacts can be valuable to cybercriminals.

Attackers could potentially use these details to create convincing phishing emails, impersonate company representatives or target employees with fraudulent banking and account-recovery messages.

Affected employees should remain alert to unexpected communications requesting personal information or login credentials.

They should also monitor financial accounts, strengthen account security and verify suspicious messages through official channels.

TSMC Is Investigating and Supporting Affected Employees

TSMC says it has started informing affected personnel and providing necessary support.

The company is also cooperating with the external cloud service provider, investigating authorities and cybersecurity specialists to establish the full scope of the incident.

Its response highlights the importance of securing third-party services, particularly when those services store sensitive employee information.

Even companies with sophisticated internal security systems can face risks when external vendors handle their data.

Why the TSMC Data Leak Matters to the Technology Industry

TSMC plays a critical role in the global semiconductor supply chain. Its manufacturing technology supports smartphones, computers, artificial intelligence infrastructure and numerous other electronic devices.

Although the company says its production systems and customer information were not affected, the incident demonstrates that cybersecurity risks extend beyond a company's primary network.

Third-party cloud providers, software vendors and other business partners can become potential weak points in an organization's security arrangements.

For technology companies handling sensitive employee and business information, stronger vendor security assessments and access controls are increasingly important.

Final Thoughts

The TSMC data leak is another reminder that cybersecurity threats can affect even the world's most important technology companies.

While hackers claim to possess approximately 46,000 employee records, TSMC has confirmed only that some current and former employees' information was exposed through a third-party cloud provider.

The company says its internal systems, manufacturing operations and customer-related information remain unaffected.

The investigation will determine how the information was accessed, how many employees were affected and what additional security measures may be required.