TSMC employee data leak: chipmaker blames cloud provider, not its systems

Taiwan Semiconductor Manufacturing Company (TSMC), the world's biggest contract chipmaker, said on Thursday, 12 November 2026, that personal data of some of its current and former employees had appeared on an outside website without permission. In a Form 6-K filing with the US Securities and Exchange Commission (SEC), the company said the leaked information matched data held in the systems of a cloud service provider it uses, and was unrelated to its chipmaking operations or to customer data. Reports said sellers on hacking forums were offering about 46,000 employee records for 3 Bitcoin, figures that have not been verified.

TSMC makes the most advanced chips used in smartphones, computers and the AI systems that are driving today's technology boom, so any security problem at the company draws close attention. In this case, the company says the problem was not inside its own network but at an outside cloud provider, a company that stores and runs data for other businesses over the internet.

That distinction matters, and it is becoming common. Many large firms now keep human-resources and payroll data with specialist cloud vendors. If the vendor is breached or misconfigured, employee data can leak even when the employer's own systems are secure. Security specialists call this third-party or supply-chain risk: a company is only as safe as the weakest partner holding its data.

For the employees involved, the risk is personal rather than industrial. National ID numbers and bank details, if the forum samples are genuine, can be used for identity fraud and targeted scams. TSMC has not said how many people were affected, which cloud provider was involved or how the data was taken, so the 46,000 figure should be treated as the sellers' claim.

What affected people should do, in general terms that apply to any such leak: watch bank accounts for unfamiliar transactions, be wary of calls and emails that quote personal details to seem genuine, and follow official guidance from their employer and bank. This story does not describe how the data was obtained, and no technical details of the leak have been published.

Peepals timeline: On Thursday, 12 November 2026, reports emerged that sellers on underground forums were offering TSMC employee records. The same day, TSMC filed its statement with the SEC confirming that some employee data had appeared online and that it matched data held by a cloud service provider, and said it was working with the provider, security firms and police. TSMC's US-listed shares fell about 4% before the market opened, according to one report. The sellers had reportedly threatened to release the data within a week if no buyer came forward.

Short-term: Current and former TSMC employees face a higher risk of fraud and phishing, and the company's investigation with its cloud provider and police continues.

Long-term: The case adds pressure on large companies to audit the cloud vendors that hold staff data, and on regulators to tighten rules on third-party data handling.

Who is affected: Current and former TSMC employees; TSMC's cloud service provider; investors in TSMC shares; and other companies that store employee data with outside vendors.

What to watch next: Whether the sellers carry out their reported threat to release the data within a week, and whether TSMC names the cloud provider or the number of people affected.

Questions and Answers