TSMC WannaCry production-line shutdown

On 3 August 2018, the Taiwan Semiconductor Manufacturing Company (TSMC) — the world's largest contract chip manufacturer and a critical supplier to Apple, AMD, and Nvidia — suffered an unprecedented disruption when a WannaCry ransomware variant swept through its production network, halting fabrication lines for two days and costing an estimated $170 million.

What happened

The infection began not with a targeted intrusion but with a supply-chain hygiene failure. A supplier connected a new fabrication tool to TSMC's network without scanning it first. The machine carried a variant of WannaCry, the worm that had caused global havoc in May 2017.

WannaCry propagates using EternalBlue (CVE-2017-0144), an exploit of a flaw in Microsoft's SMBv1 protocol leaked from the NSA. Although Microsoft had patched the vulnerability more than a year earlier, TSMC's fabs ran thousands of unpatched Windows 7 machines hosting the tool-automation interface that controls manufacturing equipment. The worm spread rapidly across these systems, causing them to crash and reboot in an endless loop rather than encrypting files for ransom.

Within hours, more than 10,000 machines were affected, forcing TSMC to shut down plants in Hsinchu, Taichung, and Tainan — some of which were producing system-on-chip components for upcoming Apple iPhones.

Impact

• Production halted for roughly two days across multiple fabs.
• TSMC estimated the incident would shave about 3% off third-quarter revenue, with total losses around $170 million (about NT$5.2 billion).
• By 5 August, around 80% of affected tools were restored; full recovery followed shortly after.
• No customer data was stolen and no ransom was paid — the damage was purely operational.

Why it matters

TSMC was a wake-up call for operational-technology (OT) security in manufacturing. The episode showed how a single unscanned tool and a population of legacy, unpatched Windows machines could idle one of the most advanced factories on earth. Industrial environments often run obsolete operating systems because requalifying production equipment is slow and expensive — but TSMC proved that this technical debt carries a nine-figure price tag.

The incident accelerated adoption of stricter equipment on-boarding, network segmentation, and patch governance across the semiconductor industry, and stands as the canonical example of a commodity worm causing strategic damage to critical supply-chain infrastructure rather than through any deliberate sabotage.