TSMC Says Leaked Employee Data Matches What a Cloud Provider Held. It Has Not Named the Provider. Current and Former Staff Should Lock Down Bank Accounts and Distrust Calls About This Leak
If you work or used to work at TSMC, treat your name and contact details as exposed, and, if the seller's claim is true, your national ID number and bank details too. TSMC has not said which fields leaked. Turn on transaction alerts with your bank, watch your accounts for activity you did not cause, and treat any call, text or email about this leak, your salary account or your ID as a scam until you have checked it through a number you already have. Do not hand over a one-time code or a password to anyone who calls you about it. In Taiwan, the 165 anti-fraud hotline is the place to check a suspicious call. Read the notice TSMC sends you directly, and do not follow links in messages that claim to be from TSMC about the incident.
If your company stores employee records (HR, payroll, benefits) with a cloud or software provider, ask each of those providers this week whether they have had an incident since October, and what your data looked like to them. TSMC has not named its provider, so no one outside TSMC and that provider can tell you yet whether you share it.
What is confirmed
TSMC filed a statement with the US SEC, dated and signed Thursday, November 12, 2026, titled "Statement Regarding the Unauthorized Access of Employee Personal Data" (Form 6-K, signed by CFO Wendell Huang). It says:
Some current and former TSMC employee data was made available on an external website without authorization.
TSMC has found no evidence that its own systems were compromised.
The data matches data held by a cloud service provider TSMC uses, and is unrelated to TSMC's operations or customer data.
TSMC is notifying affected employees, providing support, and working with the cloud vendor, the relevant authorities and a third-party cybersecurity firm to establish the facts.
That is the whole primary record we could find. TSMC's own newsroom listed no item on it when we checked on November 15; its November entries were the October revenue report and the board resolutions, both November 10.
What the seller claims (not confirmed by TSMC)
BleepingComputer reported on November 15, with a forum screenshot from the threat intelligence firm KELA, that on Sunday, November 8 a forum user calling themselves "SmithBianl" posted a 499-row text file as a sample. The seller said it came from a 6.9GB dataset of 46,000 employee records, and that the set includes national ID numbers, addresses, contact details and banking information. The seller asked for bids starting at 3 BTC and said the data would be released free if no buyer appeared, with a first deadline of November 15.
Those numbers are the seller's. TSMC has not confirmed a count, and its statement does not list which fields were exposed. One outlet, Wccftech, put the figure at 49,000; we found no source for that number and use the 46,000 that the forum post reportedly states. No group has claimed it under a known name; "SmithBianl" is a forum alias, and no primary attributes it to any known actor. We do not either.
What is not known
Which cloud provider. TSMC says only "a cloud service provider."
Whether that provider's other customers were affected. Nothing published by TSMC or the provider says.
When the data was taken, and when TSMC or the provider discovered it. The only dates on record are the forum post (November 8, per BleepingComputer and KELA), TSMC's statement (November 12) and the press reports (November 15).
How many people are affected, as a confirmed number, and whether the sample is genuine in every field.
Whether TSMC has contacted the seller. BleepingComputer asked; TSMC declined to comment.
The pattern, stated carefully
This is the second disclosure in a week where a company says its own systems were not the way in and points at an unnamed cloud provider. Fireworks AI did the same on November 9 (our post: "Fireworks AI Disclosed a Second Breach in a Month, Through a Cloud Provider It Does Not Name"). We have no evidence that it is the same provider, and neither company has named one. The point for defenders is narrower: when your vendor's answer is "not our systems," the next question is whose systems, and you are entitled to ask it.
How we know, and how we checked
We read BleepingComputer's report first, then the TSMC statement it links on SEC EDGAR, which is the primary. We checked TSMC's newsroom and searched in English and Chinese for a Taiwan Stock Exchange material-information notice or a provider notice; we found neither, so the SEC filing is the one primary we read. The field list, record count, sample size, alias, price and deadline all trace to one source: the seller's forum post, as captured by KELA and reported by BleepingComputer. Other outlets we saw (ShiftDelete, Wccftech, BigGo Finance, WindowsForum) repeat that report and add no new primary material. One outlet attributed the field list to Taiwan News; we did not read that report.
No indicators of compromise were published in the sources we read, so we have added nothing to our feed for this incident.
Sources
TSMC, Form 6-K, "Statement Regarding the Unauthorized Access of Employee Personal Data," November 12, 2026: https://www.sec.gov/Archives/edgar/data/1046179/000104617926000800/a20261112statementregardin.htm
BleepingComputer, "TSMC employee data breach linked to cloud provider," Bill Toulas, November 15, 2026: https://www.bleepingcomputer.com/news/security/tsmc-employee-data-breach-linked-to-cloud-provider/
TSMC newsroom (checked November 15, no item on this incident): https://pr.tsmc.com/english/latest-news
Wccftech (49,000 figure, unsourced): https://wccftech.com/taiwan-chip-giant-tsmc-acknowledges-hack-of-reportedly-49000-employee-files-occurred-but-says-leaked-data-matches-that-stored-with-external-cloud-provider/
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.
Comments