Overview
- TSMC disclosed Thursday that personal information for some current and former employees was posted without authorization and that the exposed records match data stored in a third‑party cloud service provider’s system.
- Hackers posted a 499‑record sample labeled "tsmc.txt" and claimed roughly 6.9 GB — about 46,000 records — were available for sale for 3 BTC, and they threatened public release if no buyer emerged.
- The company says there is no evidence its internal networks, production systems, or customer data were compromised and that it is notifying impacted staff and providing support.
- TSMC has engaged the cloud vendor, law enforcement, and external cybersecurity firms to investigate and remediate the incident while monitoring whether the remainder of the dataset is sold or published.
- The event underscores a wider trend of attackers targeting smaller vendors that hold sensitive data and raises clear risks of identity theft and targeted phishing against employees if the files circulate publicly.