TSMC confirms employee data breach tied to cloud service provider

One of the largest semiconductor manufacturers in the world said one of its cloud service providers was breached, allowing cybercriminals to steal troves of information on current and former employees.

Taiwan Semiconductor Manufacturing Company (TSMC) filed notice with the Securities and Exchange Commission on Thursday warning of the incident. 

An investigation into the breach found that no TSMC systems were compromised but the information was “verified to match data stored in the system services of a cloud service provider, but is unrelated to the company’s operations or customer-related data.” The cloud service provider was not named.

“We have been informing impacted personnel and are providing them with necessary support. TSMC has engaged with both the cloud service vendor, the relevant investigating authorities, and a third-party cybersecurity agency to jointly ascertain the facts and take necessary actions,” the company’s chief financial officer Wendell Huang said in the notice. 

The SEC filing comes after a cybercriminal forum post on November 8 where a hacker offered 6.9 GB of employee data that allegedly includes contact information, identification details and banking information. The hacker demanded 3 BTC, or about $200,000, for the information. 

TSMC did not respond to requests for comment on the specifics of the post. TSMC is one of the most profitable companies in the world, reporting a revenue of $122 billion last year. It controls more than 70% of the semiconductor market — supplying Nvidia, Apple, Broadcom, Qualcomm and other tech giants. 

The company has dealt with several cyberattacks over the last five years. It fired two employees last year whom it suspected of stealing and attempting to share cutting-edge trade secrets and dealt with a ransomware attack in 2023 involving one of its IT hardware suppliers.