Author: Kuri, Deep Tide TechFlow

Deep Tide Introduction: On November 12, hackers publicly sold on underground forums claimed to have obtained 6.9GB of data belonging to TSMC, covering about 46,000 records of employee personal data, with a price tag of 3 bitcoins (approximately 7.4 million NTD), and threatened to release all data online if no one acquired it within a week. TSMC issued a statement that day confirming that some data of current and former employees had indeed leaked, but emphasized that its own systems had not been breached; the issue originated from the system of a partnered external cloud service provider, and did not involve wafer production or customer commercial secrets. This means that the hackers' extortion path again bypassed the semiconductor giant’s robust internal network firewall, instead targeting supply chain vulnerabilities that are more difficult to penetrate.

The most secure front line of the global semiconductor supply chain has once again been breached at the external vendor stage.

According to reports from "This Week" and the Central News Agency of Taiwan on November 12, hackers posted on underground dark web forums like DarkForums and BreachForums, claiming to have acquired internal data from the wafer foundry giant TSMC (Taiwan Semiconductor Manufacturing Company), with a total file size of 6.9GB, containing approximately 46,000 employee records. The asking price set by the hackers was only 3 bitcoins, equivalent to about 7.4 million NTD (approximately 220,000 USD) at current market rates. The poster also set a one-week countdown, threatening to make all data public for free if no one purchased it by the deadline.

46,000 records marked with a price, hackers released samples of 19 detailed fields

To prove the authenticity of the data to potential buyers, the hackers publicly released a sample file named "tsmc.txt" in the forum.

According to Taiwanese media "Wind Media," the publicly available sample contained 499 personnel records, with each record including 19 detailed fields. In addition to basic information such as employee name, date of birth, job title, nationality, and ID number, it also provided detailed listings of addresses, personal phone numbers, email addresses, bank account information, and even the real names, phone numbers, and addresses of emergency contacts.

Experts from the Taiwan Information Security Association (TWISA) pointed out in an interview with "This Week" that once the organizational structure and private information of such core technology companies leak, they directly face targeted phishing and social engineering scams, where criminals can easily impersonate HR or management to contact employees' relatives; the longer-term impact involves intelligence gathering and poaching of key talent in advanced semiconductor processes.

TSMC investigates and identifies external cloud vendor; core processes and customer data unaffected

In response to the sudden data leak, TSMC quickly came forward to clarify on the afternoon of November 12.

According to the official statement from TSMC, after discovering that information of some current and former colleagues had been posted on an unauthorized external website, the company immediately activated its emergency response process. TSMC clearly stated that, as of now, there is no evidence indicating that TSMC’s internal IT systems or wafer manufacturing equipment had been hacked.

The statement further indicated that preliminary comparisons show that the leaked content corresponds to data from a partnered cloud service provider’s system services, and this batch of data does not involve TSMC’s chip production operations and customer-related information. Currently, TSMC has been gradually providing assistance to affected employees and is collaborating with the involved cloud service provider, judicial investigation agencies, and third-party cybersecurity institutions to trace the source.

"Wealth Weekly" noted in its industry analysis that TSMC has implemented extremely tight physical network isolation for operational technology (OT) and corporate intranet (IT). In the third quarter of 2026, TSMC’s quarterly after-tax net profit reached 763.064 billion NTD, with advanced process revenue accounting for as much as 79%, and its core manufacturing fundamentals were not directly harmed by this incident.

The supply chain has once again become the weakest link, hackers' extortion fully shifting to external outsourcing chains

This is not the first time TSMC has been caught up in hackers’ extortion against external partners.

Public records show that in June 2023, the well-known ransomware organization LockBit listed TSMC as a victim on its dark web page, demanding a ransom of 70 million USD. Subsequent investigations confirmed that the true target of the cyber attack was TSMC's hardware equipment supplier, Kinmax Technology; what leaked were merely initial configuration files of the shipping testing environment, and TSMC’s own network remained secure.

Three years later, the script has replayed, but the attack target has shifted from hardware outsourcing vendors to cloud application service providers.

Cybersecurity industry observers pointed out that modern large multinational corporations have invested massive security budgets at their own network boundaries, making it extremely challenging to attack core data centers; hence, hackers' strategies have fully transitioned to target outsourced HR systems, third-party collaboration tools, and vulnerabilities in external cloud service platforms' APIs and configurations. For a wafer giant with annual revenue in the trillions of NTD, the 3 bitcoins demanded by the hackers, though not a large amount, carry significant reputational damage.

For TSMC’s current and former employees, the next few months will require vigilance against phishing and fraud perpetrated by impersonators; for the entire semiconductor industry, this sale of 3 bitcoins has once again sounded the alarm: no matter how high the internal network firewalls are erected, they cannot block the backdoors left by third-party service providers.