Taiwan Semiconductor Manufacturing Company (TSMC) has acknowledged that data belonging to some current and former employees was disclosed without authorization, after a hacker reportedly offered the information for sale on an underground forum. The seller is asking for 3 BTC — roughly $214,700 — and claims to hold more than 46,000 records, according to the report.
The hacker reportedly threatened to release the records publicly if payment is not made within one week. However, the individual is not described as holding the data for ransom in the traditional sense; there had been no reported demands or blackmail attempts directed at the company, with the seller instead seeking a buyer for the information.
TSMC says no sign of system compromise
In its response, TSMC said its preliminary investigation found no real evidence that any of its security systems were compromised. The company's preliminary report indicated that the data matches information held in the system service of a certain cloud service provider.
TSMC also clarified that the data in question was not associated or linked with any clients or production. The chipmaker said it is working with cloud service providers and cybersecurity agencies to better understand the incident and is taking measures aimed at preventing a recurrence.
The case is not a conventional ransomware attack, since no malware was used and TSMC has not been locked out of its systems.
Ransomware activity continues to grow
The incident comes amid a broader increase in ransomware disclosures. According to Black Kite's ransomware report, disclosures rose 24% year-over-year compared with the previous disclosure period. The report also found that the threat actor ecosystem grew alongside the victim count, reaching 127 active groups by the close of the period and 146 by June 2026.
Manufacturing accounted for around 22% of all ransomware attacks, the report found, while professional, scientific and medical services accounted for another 18% of the total share. The ransomware breach targeting DaVita Inc. in 2025, which affected more than 2.7 million patients, was cited as a prominent example.
TSMC has faced ransomware before. In 2023, the company was targeted by the LockBit group, which demanded $70 million at the time.
Attention shifts to Nvidia
The timing of the disclosure coincided with Nvidia dominating headlines after CEO Jensen Huang resigned following an extramarital scandal. Related stocks, including IREN, Core Scientific and TeraWulf, fell in the hours following the resignation.
Key points
- TSMC confirmed that data of some current and former employees was disclosed without authorization.
- A hacker reportedly claims to hold more than 46,000 records and is seeking 3 BTC, or about $214,700.
- TSMC said there is no real evidence its security systems were compromised and that the data was not linked to clients or production.
