TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider

Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed that personal data belonging to some current and former employees appeared online without permission.

The chipmaker disclosed the incident on November 12, 2026, saying the exposed information matched records stored by an outside cloud service provider. It found no evidence that its own systems had been compromised.

The company said the TSMC data breach involves employee information rather than chip production or customer records. Its statement leaves several questions unanswered, including how the information was obtained, which cloud provider held it, and how many people were affected.

Anonymous sellers reportedly offered 46,000 TSMC employee records on DarkForums and BreachForums for three Bitcoins, threatening to publish the dataset within a week if no buyer emerged, according to Taiwan News, though the figures remain unverified.

TSMC Data Breach

Reports also describe the claimed dataset as 6.9GB. Samples reportedly contained names, national identification numbers, and bank account information.

TSMC has not publicly confirmed a complete list of exposed fields, so it’s important to separate reported details from forum samples from findings verified by the company.

The reported combination could create lasting risks for affected workers. Names linked to identity and banking details can help criminals build convincing messages that appear to come from payroll staff, banks, or support teams. However, the public reports do not establish that stolen information has already been used for fraud.

In its November 12 regulatory filing, TSMC said it verified the information against data stored in a cloud provider’s services. That finding links the exposed records to an outside service but does not explain how attackers obtained them.

No confirmed entry point, malware strain, exploited vulnerability, or stolen account has been disclosed. Claims that attackers directly entered TSMC’s network would therefore go beyond the available evidence. The provider’s identity and the service it supplied also remain undisclosed.

The case brings renewed attention to cloud access controls. Cybersecurity News previously covered UNC5537 attacks against Snowflake customer accounts, where stolen credentials and missing multifactor authentication enabled data theft. Those findings describe a separate campaign, not the cause of this incident.

Its coverage of the suspected Snowflake hacker’s arrest also shows how cloud data theft can trigger investigations across several affected businesses. No connection between those cases and the TSMC leak has been established.

TSMC says it is informing impacted personnel and providing support. It is working with the cloud vendor, investigating authorities, and an outside cybersecurity agency to establish the facts and take action.

For now, the confirmed scope remains an employee data exposure linked to records held by a third party. The investigation still needs to determine how those records left that environment and the final number of people affected.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs

The post TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider appeared first on Cyber Security News.