Offered for 3 Bitcoins on Underground Forum
Leading contract chipmaker TSMC has been hit by an alleged employee data leak, with someone on an underground forum claiming to hold about 46,000 employee records totaling 6.9GB in size, and seeking buyers at a price of 3 bitcoins, equivalent to about NT$7.4 million. The seller also threatened to release all the data if no buyer is found within a week, drawing market attention.
Whether the 46,000 records circulating publicly are all valid employee data, what fields the actual data includes, and how the data was obtained still require further investigation. The claims so far come only from forum posts and general media reports, and the actual contents of the data have not yet been fully verified by an independent third party.
TSMC Confirms Leak, Denies System Breach
TSMC confirmed today (12th) that information of some current and former employees was disclosed without authorization. The company said there is currently no evidence that its internal systems were breached, and its preliminary understanding is that the disclosed information matches data held in a cloud service provider's system services, and is unrelated to production or customer-related data.
TSMC said the source of the incident and the actual scope of impact remain to be clarified. The focus of public attention includes the actual number of records disclosed, the personal information fields involved, how the data flowed out of the cloud service, and whether the relevant supplier has information security management gaps, all pending further explanation following the investigation.
Affected Personnel Notified, Investigation Under Way
Regarding the unauthorized disclosure of employee information, TSMC said it has been notifying affected personnel and providing necessary assistance, while working closely with the relevant cloud service provider, investigative authorities, and third-party cybersecurity organizations to clarify the cause and take necessary measures. The company also said it remains committed to protecting employee privacy and maintaining information security.
Even if this incident does not mean the company's core systems were breached, the unauthorized disclosure of employee personal data may still create personal privacy and follow-on fraud risks. If the data includes names, contact details, or employment information, it could be used by criminals to craft phishing messages impersonating the company, colleagues, or partner vendors. Affected personnel should remain alert to unknown contacts and messages requesting account numbers, passwords, or verification codes, and verify identities through official channels.