The personal data of roughly 46,000 Taiwan Semiconductor Manufacturing Company employees has been put up for sale on underground forums for about 3 BTC. TSMC confirmed the incident on Thursday but said its own systems were not compromised, blaming an outside supplier for the breach.
Nearly 7GB of employee records were listed on DarkForums and BreachForums, with the seller demanding about NT$7.4 million, or $220,000, from interested buyers. The auction was opened for one week, and the seller threatened to release the dataset for free if no deal was reached.
TSMC said the exposed information appeared on external websites without authorization and matched records held by a cloud service provider. The company added that the data does not include chip production or customer information. It is working with the unnamed vendor, outside cybersecurity firms, and investigators to trace the root cause and has begun notifying affected employees.
To prove the haul was real, the seller released a sample file named “tsmc.txt” containing 499 records with 19 fields each. The exposed data reportedly includes names, birth dates, job titles, nationalities, national ID numbers, home addresses, mobile numbers, and emails. Stolen bank account details also led to secondary exposure of emergency contacts, increasing phishing and social engineering risks.
The breach adds to a recent run of third-party data incidents affecting Taiwanese companies, including job bank 104, e-commerce platform 91APP, SinoPac Bank, and travel site eztravel. TSMC was previously targeted in June 2023, when the LockBit ransomware gang demanded $70 million after a breach involving third-party IT hardware supplier Kinmax Technology.
