TSMC’s Cloud Leaked. 46,000 Employees Exposed.

The world’s biggest chipmaker got breached — and it did not happen through its own systems. TSMC confirmed this week that data on roughly 46,000 current and former employees appeared on an external website after a leak at a third-party cloud provider. A hacker is demanding three Bitcoins, about $200,000, not to release the files publicly. The sample already posted includes home addresses, bank account numbers, and emergency contacts for 499 employees.

TSMC’s statement is precise about what happened and what did not. “TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC’s systems have been compromised,” the company said. The data, it added, “has been verified to match data stored in the system services of a cloud service provider, but is unrelated to the company’s operations or customer-related data.” TSMC says it is working with the affected employees, the cloud provider, investigators, and cybersecurity organizations. The news sent TSMC’s stock slipping on Thursday, as investors priced in the legal and regulatory risk that follows a breach.

What was taken

The hacker claims the stolen files total 6.9GB and cover around 46,000 employee records. The sample posted so far covers 499 people, and it is the kind of data that makes phishing easy: real names tied to real addresses, real bank account numbers, and emergency contacts. That combination is worth far more to a criminal than a password list — it lets a scammer write a message that sounds like it comes from inside the company, about a real person, with real details.

What was not taken matters too. TSMC says its own systems were not compromised, and the leak does not touch its operations or customer data — no chip designs, no production data, no customer information. The distinction is real, but it is cold comfort for the 46,000 people whose bank details are now in criminal hands. The world’s most secretive manufacturer protects its trade secrets fiercely; its employees’ personal data was sitting in a provider’s system with weaker protection.

The pattern keeps repeating

This is the third time in a month the blog has covered a breach that came through a third-party provider rather than the victim’s own network. In the Finnair case, a breach at the Amadeus booking system exposed around 116,000 bookings over three years. In the Iris Ohyama case, a suspicious file in a third-party cloud service exposed up to 7.7 million shoppers. Now TSMC: a cloud provider’s system, 46,000 employees.

The pattern is the point. Companies audit their own networks and then hand their data to providers whose security they never see. The provider is not named here — TSMC has not identified it — and that anonymity is part of the problem. Customers and employees cannot judge a risk they cannot see, and the company whose name is on the breach notice is the one that takes the reputational hit.

There is also a reason TSMC is a prime target beyond its size. Its employees are valuable sources of knowledge that competitors seek to recruit. Last year, Taiwan’s Ministry of Justice Investigation Bureau accused China’s largest chipmaker, SMIC, of secretly recruiting TSMC engineers to gain Taiwanese semiconductor know-how, and Huawei has similarly targeted TSMC talent with salaries up to triple their current pay. Employee data is not just a phishing asset here — it is a recruiting map.

What to do now

If you are a TSMC employee, current or former, treat any message that uses your real address, bank details, or emergency contacts with suspicion — especially anything claiming to be from HR, your bank, or TSMC itself. Verify through official channels before clicking or replying. Check your bank statements for unfamiliar activity, and consider a fraud alert with your bank and credit bureau.

If you run a company, this is a vendor-risk story, not a TSMC story. Audit what employee data lives in third-party clouds and which provider holds it. Require breach-notification clauses with real deadlines in vendor contracts, and treat employee data with the same rigor as customer data in your risk reviews. The next breach notice with your company’s name on it may come from a system you have never seen.

TSMC’s own systems held. Its employees’ data did not — because it was not in TSMC’s systems. That is the lesson of this breach, and of the two before it: the perimeter you defend is no longer the perimeter that matters.