Seller Claims to Offer 46,000 TSMC Employee Records for 3 Bitcoin
Key Facts
Taiwan Semiconductor Manufacturing Co. (TSMC) said on November 12 that information about some current and former employees had appeared on an external website without authorization, and that it had so far found no evidence its systems were breached. The announcement came after a seller claimed to be offering records attributed to the company’s employees, according to Taiwan’s Central News Agency (CNA). The seller said the archive contained 46,000 records totaling 6.9 gigabytes and asked 3 Bitcoin for it. Those figures and the price remain claims attributed to the seller, while the company confirmed that unauthorized information had appeared externally. TSMC’s statement centers the incident on employee information associated with an external service, while reiterating that it had found no evidence its systems were breached.
TSMC said the exposed information matched data held in system services at a cloud service provider, and said it was not connected to production or customer data. The company did not name the provider in the statement reported by CNA, nor did it specify how access to the information was obtained or how it appeared on the external website. The company’s description means the data is associated with a service provided by a third party, while manufacturing systems and customer information were not shown to be involved. These boundaries remain important in describing what the company disclosed: employee information published without authorization, with no evidence so far that its systems were breached. The available information did not include further details from the company about the type of data that matched the provider’s records.
CNA said the seller posted an offer for 46,000 records in a 6.9-gigabyte file, priced at 3 Bitcoin. It also quoted the seller as threatening to publish the full dataset if no buyer was found within a week. Offers to sell the records were posted on underground forums, including DarkForums and BreachForums, according to Taiwan News, citing Taiwanese media reports. Taiwan News added that samples from those forums included names, national ID numbers and bank account information, attributing those details to Business Next. The appearance of samples or a sales offer does not mean that all of the alleged records have been verified or that the full archive was published; the data volume, record count, price and deadline are all details attributed to the seller.
TSMC has begun notifying affected employees and offering them assistance, according to CNA. The company said it was working with the cloud service provider, investigators and an independent cybersecurity agency to clarify the facts and take the necessary steps. This approach combines outreach to the people concerned with an investigation into data associated with the external service. The statement did not specify when the investigation would be completed or detail the steps the company would take afterward. The seller, meanwhile, tied the publication threat to a one-week deadline to find a buyer, according to CNA; the available information did not say what happened when that deadline passed.
A previous TSMC initiative with suppliers provides context on the company’s focus on supply-chain security, without establishing why employee data appeared in this incident. At a supplier cybersecurity workshop held in June 2024, the company said supplier satisfaction was 98%, based on 457 post-event surveys. It added that 95% of participants agreed that sharing experience helps improve cybersecurity management and build a more resilient supply chain. Those figures relate to the workshop’s evaluation and knowledge-sharing among suppliers; they do not establish a link to the current incident or the service provider involved. The investigation announced by the company, in cooperation with the provider, relevant authorities and independent experts, remains the stated process for clarifying how the information appeared.
In trading, TSM’s ADR closed at $413.35 on November 11, according to EL7 data. That was the closing price in the session before CNA’s report was published on November 12, and by itself does not establish a market reaction to the news. The available information did not include a price or trading move for the ADR in the November 12 session. The next steps announced by the company include notifying affected employees and continuing to work with the service provider, investigators and the independent cybersecurity agency. The threat to publish the data within a week remains part of the seller’s offer, while TSMC said it had so far found no evidence its systems were breached.