Taiwan Semiconductor Manufacturing Company has confirmed that personal data belonging to some employees was exposed through a third-party cloud system. The hackers behind the leak are seeking 3 BTC, or around $220,000, for the records.
TSMC announced the incident on November 12, 2026. The chipmaker said its own internal systems were not breached and that production operations and customer data were unaffected.
What the hackers claim to have
The breach came to light after the hackers claimed to have obtained approximately 46,000 employee records. The haul reportedly totals 6.9 GB of data and covers both current and former staff.
The records were offered for sale on online forums, including DarkForums and BreachForums, with a starting price of 3 BTC, roughly $220,000 at the time of the listing. The sellers also set a deadline: if no buyer stepped forward within a week, they threatened to release the full dataset publicly.
To support their claim, the hackers released a sample file named tsmc.txt. It contained 499 records, each with 19 fields of information. The fields shown in the sample include names, national IDs, home addresses, phone numbers, email addresses, bank information, job titles and emergency contacts.
How TSMC is responding
TSMC’s position is that the leak originated with an outside cloud service provider, not its own infrastructure. The company says no internal system was compromised.
TSMC is notifying the individuals whose information was exposed. It is also working with the cloud vendor, law enforcement and external cybersecurity firms to limit potential fallout.
An earlier extortion attempt
This is not the first time TSMC has faced a ransom demand. In mid-2023, the LockBit ransomware group targeted the company, with the extortion attempt centered on a hardware supplier rather than TSMC’s own operations. That episode did not cause significant operational damage.
In both cases, the attackers came in through a partner rather than directly through the company.
Why the vendor angle keeps coming back
Large companies have spent years hardening their own networks. As a result, attackers increasingly go after the smaller businesses that hold the big company’s data on its behalf. The TSMC case fits that pattern: the company’s core operations appear intact, yet the personal information of its workforce traveled through an external system and ended up for sale.
What to watch
For investors, the headline facts are reassuring on the operational side. TSMC says production and customer data were not touched, which is the part of the business that drives revenue and client trust.
Bitcoin transactions are recorded on a public ledger. Any payment to the sellers would leave a visible trail, which is one reason law enforcement involvement in cases like this matters.
- Whether the hackers follow through on their threat to publish the full dataset once their one-week window closes.
- Whether TSMC or its cloud vendor discloses more about how the data was accessed.
- Whether regulators in Taiwan or elsewhere take an interest in the vendor’s security controls.
