TSMC confirms employee data breach traced to external cloud provider as hacker demands 3 bitcoin (2026)

On 12 November 2026, TSMC — Taiwan Semiconductor Manufacturing Company, the world's largest contract chipmaker and the foundry behind the most advanced processors used by Apple, Nvidia and others — confirmed that personal data belonging to some of its current and former employees had been disclosed without authorisation. The confirmation followed the appearance of the data on an underground forum, where a hacker offered the trove for three bitcoin (worth roughly $215,000 at the time) and set a one-week deadline to find a buyer.

What happened

According to TSMC's preliminary assessment, the exposed records matched data held in the systems of an external cloud service provider rather than TSMC's own internal network. The company said it found no evidence that its own security systems had been compromised, and stressed that the leaked information was unrelated to its manufacturing operations or to any customer data. The seller claimed to hold more than 46,000 employee records, though TSMC did not confirm a figure; those numbers come from the attacker and have not been independently verified.

Response and context

TSMC said it was investigating the incident and working with the third party involved; reporting indicated the chipmaker moved to terminate its relationship with the cloud provider identified as the source of the leak. The breach briefly weighed on TSMC's share price. It is not the first time the company has been named by cybercriminals: in 2023 the LockBit ransomware group listed TSMC after a breach at one of its hardware suppliers, and in 2018 a WannaCry variant halted production lines across several of its fabrication plants.

Why it matters

For a company whose value rests on protecting cutting-edge process technology, the reassurance that production and customer data were untouched matters greatly — but the incident is a reminder that even the most security-conscious manufacturers inherit risk from the third-party services that hold their employee and administrative data. Workforce records exposed in such a leak can fuel targeted phishing and identity theft against staff at one of the world's most strategically important technology firms.