Seller Claims to Offer 46,000 TSMC Employee Records for 3 BTC
Key Facts
Taiwan Semiconductor Manufacturing Co. (TSMC) said on November 12 that information about some current and former employees had been posted on external websites without authorization, and that it found no evidence its systems had been breached. Taiwan’s Central News Agency reported that the announcement followed a seller’s claim to possess employee records and offer them for sale. According to the agency, the seller said the archive contained 6.9 gigabytes and 46,000 records, and set a price of 3 BTC. The seller threatened to publish the full data if no buyer was found within a week. The record count and sale terms remain claims by the seller, while the company confirmed that unauthorized information had appeared externally.
TSMC said the published information matched data held in a system at a cloud services provider and was unrelated to production or customer data. The company said it had found no evidence its systems were breached, placing the incident, in its description, within the scope of employee information associated with an external service. The company did not name the provider or explain the nature of the service it supplied, Taiwan News reported. The link suggests the investigation is focused on data held by a cloud services provider, while the company has not said how access was obtained or how the information appeared on external websites. It also said the leak did not include information about its customers or production operations.
TSMC said it had begun notifying affected people and providing necessary assistance, while working with the cloud services provider, the authorities investigating the matter and independent cybersecurity specialists. It added that the cooperation aims to clarify the circumstances of the incident and take necessary measures. In the statement carried by the Central News Agency, the company did not give a timeline for completing the investigation or details of the steps it would take. The seller, meanwhile, set a one-week deadline before publishing the data, according to reports by the agency and Taiwan News. The reports did not say whether a buyer had been found or whether the data had been published in full.
Taiwan’s Central News Agency carried the company’s statement and details of the offer in a report published on November 12 at 12:59 local time and updated at 13:10. The report said the offer was valued at 3 BTC, according to the seller, without independently confirming the number of records or the accuracy of all the archive’s contents. The incident comes as companies rely on outside service providers, but the information available in this case concerns employee data held by a cloud service and does not establish that chip manufacturing systems were breached. In the broader context of supplier security, TSMC said in its 2024 annual report that a cybersecurity workshop brought together nearly 800 participants from about 500 suppliers. The company presented the workshop as part of its efforts to reduce supply-chain security risks.
In trading, TSM shares closed at $413.35 on November 11, according to EL7 data. That was the close of the session before the November 12 report and, on its own, does not establish the market’s reaction to the news of employee information appearing online. The data provided did not include a price or share move for the November 12 session, so the market context here is limited to the dated close. The next step identified by the company is to continue working with the service provider, investigators and security experts, while notifying affected people and providing assistance. The seller’s announced one-week publication deadline remains tied to its claim, while TSMC has not named the service provider or announced the investigation’s findings.