TSMC Confirms Employee Data Leaked to External Site via Cloud Provider, States No Evidence of Internal System Breach
TSMC confirmed that some employee data was leaked to an external website via a third-party cloud provider, stating there is no evidence of an internal system breach.
On November 12, TSMC stated that personal information of some current and former employees was unauthorizedly posted on an external website. The company emphasized that there is currently no evidence showing its internal systems were breached, and it has notified affected individuals to provide necessary assistance.
According to INSIDE, TSMC explained that the leaked data matched records within a certain cloud service provider's system and was unrelated to the company's production or customer data. TSMC is cooperating with this cloud provider, investigative authorities, and a third-party cybersecurity firm to clarify the incident, though it did not disclose the supplier's name or the specific fields of the leaked information.
Prior reports indicated that hackers named TSMC in underground forums selling employee personal data. The seller claimed to have 6.9 GB of data covering approximately 46,000 employees, priced at 3 BTC, and threatened to release all data if no buyer was found within a week. These figures are solely the seller's claims and unconfirmed by TSMC; the actual number of affected individuals and scope of data remain pending further investigation.
The key aspect of this incident is that the data leak occurred not within TSMC's own systems but through outsourced cloud services. When enterprises entrust HR or employee data to third parties for storage, they effectively transfer part of their protective responsibility; if a supplier fails, it is still the enterprise's own employees who suffer.