TSMC data breach: was the chipmaker hacked? What we know

TSMC, the world’s largest contract chipmaker, confirmed on 12 November 2026 that personal data on some current and former employees has been posted online without authorisation. It says the data matches records held by a cloud service provider and that it has found no evidence its own systems were breached. A seller on two cybercrime forums wants 3 bitcoin for what it claims are 46,000 employee records.

TSMC has not named the vendor, said how many people are affected or explained how the data was taken. Ransomnews checked how often TSMC logins turn up in infostealer logs, the usual raw material for break-ins at cloud services. TSMC barely registers: 37 staff logins, against 1,567 for Intel and 2,146 for Samsung. If a stolen login was involved, the place to look is the vendor, which nobody has named.

In brief

• TSMC confirmed on 12 November 2026 that data on some current and former employees was posted on an external website. It says the data matches records in a cloud service provider’s system and that its own systems show no sign of compromise.
• A seller on DarkForums and BreachForums claims 46,000 records in 6.9 GB and wants 3 bitcoin, about NT$7.4 million. Those numbers are the seller’s and have not been confirmed.
• A sample reportedly shows 19 fields per person, including national ID numbers, home addresses, bank details and emergency contacts.
• TSMC has not named the vendor, the number of people affected or the way in. It says production and customer data are not involved.
• The Alerts.bar index that Ransomnews licenses holds 37 infostealer-captured logins for TSMC staff addresses, one of them from the last 30 days. TSMC ranks 14th of the 18 chipmakers we checked.
• The seller threatened to publish everything if no buyer appeared within a week. The listing spread on social media on 11 November, which puts the deadline around 18 November.

Was TSMC hacked?

Not by its own account. In a statement filed with the US Securities and Exchange Commission on 12 November and signed by chief financial officer Wendell Huang, TSMC said some current and former employee information had been placed on an external website without authorisation. It added: “we have found no evidence that TSMC’s systems have been compromised.” The data, it said, has been checked against records stored in a cloud service provider’s system services and matches them, and it has nothing to do with company operations or customers.

That wording is narrow. It confirms that real employee data is out. It does not say the vendor was breached, only that the data matches what the vendor holds. A cloud platform can be emptied by someone who logs in with a valid customer account, which is neither a hack of TSMC’s network nor, strictly, a hack of the vendor. TSMC says it is notifying the people affected and working with the vendor, investigators and an outside cybersecurity firm.

What employee data was exposed?

TSMC has not listed the fields or the number of people. Everything more specific comes from the seller. The listing claims about 46,000 employee records in 6.9 GB, according to Taiwan News. A sample file named tsmc.txt holds 499 records with 19 fields each, Next Apple reported: name, date of birth, job title, nationality, national ID number, home address, mobile number, email address, bank information, and the phone numbers and addresses of emergency contacts.

TSMC employed more than 90,000 people at the end of 2025, according to its annual report. If the seller’s count is right, the records would equal about half of today’s workforce, although the listing mixes current and former staff. Ransomnews has not opened the listing or the sample and cannot verify the count, the size or the fields.

Who is selling the data, and for how much?

An unnamed seller, on DarkForums and BreachForums. The asking price is 3 bitcoin, about NT$7.4 million or roughly US$220,000, and the post threatens to release the full set if nobody buys it within a week. Screenshots of the listing circulated on X and Threads on the evening of 11 November, which puts the deadline around 18 November.

No ransomware group has claimed the theft, and nothing public points to encryption or any disruption at TSMC. This is stolen data with a price tag, not a ransomware attack.

Which cloud vendor held the data?

TSMC has not said, and Ransomnews will not guess at a name. The reported fields, bank details and emergency contacts among them, are the kind of records an HR, payroll or benefits platform holds. That is our reading of the field list, not something TSMC has stated.

It would not be the first time TSMC’s name reached a criminal site through a supplier. In June 2023 an affiliate of LockBit listed TSMC with a US$70 million demand. TSMC said the intrusion was at Kinmax Technology, one of its IT hardware suppliers, and Kinmax confirmed an attack that began on 29 June, The Record reported at the time.

Could stolen logins be behind the TSMC leak?

Possibly, but nothing shows it yet. The pattern is well documented. In 2024 Mandiant traced data theft from about 165 Snowflake customers to logins captured by infostealer malware and used against accounts that had no multi-factor authentication, as SecurityWeek reported. Nobody broke into Snowflake. The attackers logged in. We explain how those logins are harvested and traded in stealer logs explained.

To see whether TSMC’s own logins are in circulation, we ran tsmc.com and 17 other chipmakers through Stealercheck, which queries the Alerts.bar index that Ransomnews licenses.

The index holds 37 logins for TSMC staff email addresses captured by infostealer malware, one of them in the last 30 days. For a company of more than 90,000 people that is low. Intel has 1,567 and Samsung 2,146, and the typical large organisation in our November infostealer report has 32.

Two other counts are higher. There are 790 logins captured on TSMC’s own login pages, 78 of them in the last 30 days. Those belong to anyone who signs in to a TSMC portal, which includes customers, suppliers and job applicants as well as staff. There are also 1,306 stolen session cookies for TSMC sites, 131 from the last 30 days. A live cookie lets an attacker skip the password and the second factor, as we set out in our piece on session-cookie theft.

These are aggregate counts, not evidence of how the data was taken. They do point away from TSMC’s own staff accounts as the obvious weak spot, and towards the question TSMC has not answered: whose login opened the vendor’s system. It could be a TSMC administrator’s account on the vendor’s platform, which need not use a TSMC email address, or an account that belongs to the vendor’s own staff. Until the vendor is named, that cannot be checked.

How we counted

The figures are all-time counts read on 13 November 2026. A staff login is a username and password pair, captured by infostealer malware on an infected device, where the username is an address at the company’s main domain. The counts include old passwords that may since have been changed. Companies that use several email domains are undercounted. Low numbers for Taiwanese, Korean and Chinese manufacturers may reflect tighter control of work accounts, or thinner coverage of those regions in the logs that reach the index, and the data cannot separate the two. We saw counts only, never the logins themselves. Disclosure: Ransomnews licenses the Alerts.bar index, and its editor-in-chief works with Alerts.bar.

How does this fit the wave of breaches in Taiwan?

TSMC is the best-known name in a run of incidents. On the day TSMC confirmed the leak, Taiwan’s Administration for Cyber Security said more than ten companies had been hit in recent weeks, affecting about 8 million personal records, CNA reported. The agency said attackers are using AI tools to find and exploit weaknesses faster.

The named cases since October include 104 Job Bank (about 120,000 résumés), the e-commerce platform 91APP (order data on about 4.79 million consumers, traced to an unpatched third-party tool), SinoPac Bank (418 accounts and NT$41.76 million in unauthorised transfers) and the travel site ezTravel (more than 690,000 people), according to a BusinessNext summary. Nothing links those cases to TSMC’s leak. What several of them share is a third party: a tool, a vendor system or a cloud service that held the data.

What should TSMC employees and other companies do?

For current and former TSMC staff, the risk is fraud that sounds convincing because it quotes real details.

• Verify before you act. Treat any call, text or email that quotes your ID number, address or bank as suspect until you have checked it through a number you already know.
• Warn your emergency contacts. Their phone numbers and addresses are reportedly in the data too.
• Watch your bank account and ask the bank about alerts for new payees and unusual transfers.
• Do not go looking for the file. Copies of leaked data offered on forums and chat channels are a common way to spread malware.

For any company that keeps employee records with an outside provider, the checks are short.

• List every outside platform that holds staff data and every account that can log in to it.
• Put those accounts behind single sign-on and multi-factor authentication, and remove the ones nobody uses.
• Check whether logins for those platforms are already in stealer logs. A password stolen from a laptop two years ago still works if nobody changed it.
• Hold less. Bank details and emergency contacts rarely need to sit in more than one system.

What happens next?

Three things are worth watching: the seller’s deadline around 18 November, whether TSMC or a Taiwanese regulator names the vendor, and whether other customers of the same vendor report leaks of their own. We will update this article when any of them moves.

Frequently asked questions

Sources and further reading

• TSMC: Statement Regarding the Unauthorized Access of Employee Personal Data, Form 6-K (12 November 2026)
• Taiwan News: TSMC reports leak of employee information (12 November 2026)
• Next Apple: report on the seller’s sample file and its fields (12 November 2026)
• United Daily News: TSMC confirms employee data leak (12 November 2026)
• CNA: Administration for Cyber Security on the recent wave of attacks (12 November 2026)
• BusinessNext: what leaked at TSMC and the recent incidents in Taiwan (12 November 2026)
• TSMC: 2025 annual report, company profile
• The Record: TSMC confirms supplier breach after LockBit claim (June 2023)
• SecurityWeek: Mandiant links Snowflake data breaches to infostealer infections (June 2024)
• Related reading on Ransomnews: the Infostealer Exposure Dataset.