TSMC Confirms Employee Data Leak as Hackers Seek 3 BTC for 46,000 Records
TSMC confirmed that personal data of some current and former employees was exposed through a third-party cloud provider, with hackers offering roughly 46,000 records for 3 BTC. The company says its internal systems, production operations and customer data were not affected, and it is notifying those whose data was exposed.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What TSMC Has Confirmed
Taiwan Semiconductor Manufacturing Company confirmed on November 12, 2026 that personal information belonging to some current and former employees was exposed through a third-party cloud service provider. The company said its own internal systems were not breached and that production operations and customer data were unaffected. TSMC has not named the provider or described the service it handled.
The scale of the claimed leak is where the sources diverge. Crypto Briefing reported that hackers claimed about 46,000 employee records totaling 6.9 GB, and that the sellers released a sample file containing 499 records with 19 fields each, including names, national IDs, home addresses, bank information and emergency contacts. CryptoPotato, citing local media, reported the same 46,000 figure but described the sample fields more narrowly as names, national ID numbers and bank account details. Neither outlet's figures have been independently verified, and TSMC's public statement, as reported, does not confirm a record count.
The Sale Offer and Deadline
Anonymous sellers listed the data on underground forums including DarkForums and BreachForums with a starting price of 3 BTC, which Crypto Briefing put at roughly $220,000 at the time of listing. The sellers set a one-week deadline, after which they said they would publish the full dataset if no buyer came forward.
Because the demand is denominated in Bitcoin, any payment would be recorded on a public ledger. That traceability is one reason law enforcement involvement is central to how the case is handled, and TSMC has said it is working with police and external cybersecurity firms.
A Pattern of Partner-Level Breaches
This is not TSMC's first extortion attempt. In mid-2023 the LockBit ransomware group targeted a hardware supplier connected to the company, not TSMC's own operations, and that incident did not cause significant operational damage. Both cases involved attackers entering through a partner rather than the company's own network.
The same pattern appears across Taiwanese and South Korean finance and travel sectors. CryptoPotato reported that travel platform EzTravel disclosed exposure of more than 690,000 customer records, and that Bank SinoPac's online banking system was exploited for unauthorized transfers totaling NT$41.76 million. In October, crypto exchange Bithumb disclosed unauthorized access to an internal workplace tool, and Coinbase reported that a security incident at its third-party analytics provider Amplitude exposed some customer contact information. South Korea's Financial Supervisory Service has opened investigations into related cases at Daishin Securities and Mirae Asset Global Investment.
What to Watch
Several open questions will determine how serious the incident becomes. The first is whether the sellers publish the full dataset when their one-week window closes. The second is whether TSMC or its cloud vendor discloses how access was obtained and which service was involved. The third is whether Taiwanese or other regulators examine the security controls of outside vendors that handle corporate employee data.
Why It Matters
For Traders
The incident is operationally contained by TSMC's account, so near-term price impact on semiconductor or crypto markets is unlikely unless the full dataset is released and disclosed.
For Investors
Repeated partner-level breaches across Asian finance and tech firms point to vendor security as a recurring governance risk worth tracking in portfolio companies.
For Builders
Third-party cloud and analytics integrations are the weak point in these incidents, so vendor access scoping and data minimization deserve review in any stack handling personal data.
This article is for information only and is not financial advice. Read the full disclaimer.
