TSMC Confirms Employee Data Leak; Sellers Seek 3 Bitcoin

By Grace Kim

Sellers claim they hold 46,000 TSMC employee records totaling 6.9 GB and want 3 Bitcoin for the files, about $220,000 at Thursday’s bitcoin price of $73,444. TSMC confirmed on Nov. 12 that data belonging to some current and former employees was posted without authorization on an external website.

The company disclosed the incident in a Form 6-K filed with the SEC. Chief financial officer Wendell Huang signed the statement.

What did TSMC confirm?

In the filing, TSMC said it had “found no evidence that TSMC’s systems have been compromised.” The company also said the exposed information “has been verified to match data stored in the system services of a cloud service provider.”

TSMC said the data is unrelated to its operations or customers. The company is notifying affected personnel. It is working with the cloud vendor, investigating authorities and a third-party cybersecurity firm. It has not named the provider or explained how the records left the provider. The Form 6-K placed the disclosure before TSM shareholders.

The filing locates the exposure inside outsourced cloud processing, rather than in TSMC’s fabs or customer designs, keeping the commercial issue centered on third-party data handling.

What do the sellers allege?

Business Next reported that sellers on DarkForums and BreachForums claim roughly 46,000 records totaling 6.9 GB. They threaten to publish everything if no one buys within a week. Local media valued the 3 Bitcoin ask at NT$7.4 million. Taiwan News carried TSMC’s confirmation the same day.

• tsmc.txt: 499 entries, each with 19 fields.
• Seller-listed fields: name, date of birth, job title, nationality, national ID number, home address, mobile number, email, bank information, and an emergency contact’s phone number and address.

Those details come from the sellers, not TSMC. The company confirmed the leak without specifying its contents. If the sample is authentic, the exposure reaches relatives listed as emergency contacts who never worked for TSMC, extending the affected population beyond company personnel.

Did the leak move TSM stock?

TSM closed Wednesday at $413.35, up 4.25%, after October revenue rose 59.7% year over year to NT$586.89 billion. Thursday’s premarket quote was $393.11, down 4.90%, amid a broad semiconductor selloff.

TradingView data showed TSM up 32.49% for the year and down 8.86% over one month. Market capitalization stood at $1.89 trillion, with a trailing price-to-earnings ratio of 25.52.

January-through-October revenue reached NT$4,485.62 billion, up 43.3%. That revenue trajectory had carried TSM stock to $430 after its third-quarter earnings report. Fourth-quarter results are due around Jan. 21, leaving investigators two months to produce a named vendor before TSMC management next faces new questions from investors.

Nvidia fell 6.03% in premarket trading after The Wall Street Journal reported that its board was preparing to remove Jensen Huang. Micron, Arm and Marvell had closed higher Wednesday. The broad reversal, rather than the leak, drove Thursday’s move; Wednesday’s gain and Thursday’s premarket fall roughly cancel.

What does the vendor pattern show?

Taiwan has logged five disclosed incidents in five weeks, and three point to an outside system.

• On Oct. 6, the 104 Job Bank said about 120,000 resumes had been read without authorization.
• On Oct. 16, 91APP reported order data for 1,329 brands and roughly 4.79 million consumers, after an unpatched flaw in third-party tool Appsmith.
• On Nov. 3, E.Sun Bank disclosed that 418 accounts lost NT$41.76 million through an external supplier’s new banking system.
• On Nov. 9, ezTravel put more than 690,000 people at risk.
• TSMC is the fifth incident and the smallest by reported affected headcount apart from E.Sun Bank.

The claimed 46,000 TSMC records amount to about one-hundredth of 4.79 million consumers affected at 91APP, making supplier exposure more material than incident scale alone.

The same pattern appears outside Taiwan. On Nov. 3, Coinbase denied a direct breach while confirming customer information exposed through an analytics vendor. DriveWealth blamed a social-engineering campaign for a Revolut customer-data breach. Gnosis Pay disclosed its own customer breach on Nov. 7.

Who bears liability under Taiwan’s data law?

Taiwan’s Personal Data Protection Act governs this arrangement. Article 4 treats a contractor that collects, processes or uses personal data for a company as the commissioning agency. Outsourcing does not transfer the obligation. Liability will depend on whether either party breached the act and whether damage followed. The allocation between TSMC and the vendor depends on the investigation and their contract.

Article 29 places the burden on a non-government body to prove it acted without intent or negligence. Where a victim cannot establish actual losses, courts may award NT$500 to NT$20,000 per person per incident. The law caps awards at NT$200 million across one event.

Article 34 allows qualifying public-interest organizations to bring group actions. TSMC has announced no compensation plan. The NT$200 million ceiling equals about US$6.4 million against TSMC’s $1.89 trillion market capitalization, making the statutory legal tail immaterial to TSM stock.

The next commercial test is whether investigators name the cloud vendor and establish whether the same provider holds process or customer data elsewhere in TSMC’s supply chain. Before fourth-quarter results around Jan. 21, investigators will have roughly two months to answer that question.