Overview
- TSMC disclosed Thursday that some current and former employee personal data was posted on an external website and said its internal systems and customer production data show no evidence of compromise.
- Hackers claim roughly 46,000 records totaling about 6.9 GB and released a 499‑record sample to prove authenticity while offering the dataset for 3 BTC with a one‑week deadline before threatened publication.
- TSMC says the exposed records match data stored in the system services of a third‑party cloud service provider and has begun notifying affected staff while engaging that vendor, investigators and external cybersecurity firms.
- The leaked fields reported in sample files include names, national ID numbers, home addresses, phone numbers, email addresses and bank details, which raise elevated risks of phishing, impersonation and financial fraud for employees.
- The incident fits a wider trend of attackers targeting smaller vendors and cloud services rather than hardened corporate networks, and it could prompt regulatory scrutiny, further disclosures about the vendor access vector and tracing of any Bitcoin payment on the blockchain.