Someone on the DarkForums and BreachForums underground forums claims to hold 46,000 TSMC employee records totalling 6.9GB, asking 3 bitcoin and threatening to publish everything if unsold within a week [1]. TSMC said some current and former employees' information was placed on an external site without authorisation, there is no evidence its own systems were breached, the data matches a cloud service provider's system, it is unrelated to production or customer data, and it has been notifying affected people [1]. Current and former employees should follow company notices and accept the assistance TSMC said it is providing; any contact involving accounts, money or verification codes should be independently re-checked, and important accounts should use multi-factor authentication [1][2].
46,000 TSMC employee records offered on underground forums; company says data came from a cloud provider and its own systems show no breach
2 min read
- Disclosed
- Nov 12, 2026
- Published
- Nov 13, 2026
- Last updated
- Nov 13, 2026
- Scale
- 46,000 records[1]
- CVSS basis
- Our assessment
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Some current and former TSMC employees; the seller claims 46,000 records with fields including name, title, date of birth, job title, nationality, national ID number, address and postcode [1].
What to do nowOur advice
Timeline
Technical details
What happened
A post on DarkForums and BreachForums claims to hold 46,000 TSMC employee records (6.9GB) for sale at 3 bitcoin, with a threat to publish the data if unsold within a week; Darkwiser said the post appeared on 8 November [1].
Scope
TSMC said some current and former employees' information was placed on an external site without authorisation, there is no evidence TSMC systems were breached, the information matches data in a cloud service provider's system, and it is unrelated to production or customer data [1]. The seller claimed fields including name, title, date of birth, job title, nationality, national ID number, address and postcode [1].
Response
TSMC said it has been notifying affected people and providing necessary assistance, and is working with the cloud provider, investigators and a third-party cybersecurity firm [1].
Remediation
References
Media3
- [1]iThome2026-11-12Accessed 2026-11-12Snapshot 2026-11-13 sha256 64a8a591ce96
“公司發現部分現職及離職員工資訊未經授權被置於外部網站,目前並無證據顯示台積公司系統遭到入侵”
- [2]民視新聞網2026-11-12Accessed 2026-11-13Snapshot 2026-11-13 sha256 0c99b2cf293f
“台積電已掌握此情形,正與相關雲端服務供應商及調查機關密切合作,以釐清狀況並採取必要措施。”
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.