TSMC employee data breached via unnamed cloud provider

Taiwan Semiconductor Manufacturing Company (TSMC) confirmed a data breach involving current and former employee information. The company filed a notice with the SEC stating that a breach occurred at one of its cloud service providers, leading to the theft of sensitive personal data including contact details, identification information, and banking data. TSMC emphasized that its own internal systems were not compromised and that the incident does not involve operational or customer data.

The stolen data, totalling 6.9 GB, was posted on a cybercriminal forum on November 8, with hackers demanding a ransom of 3 Bitcoin (approximately $200,000). TSMC is working with the cloud provider, authorities, and a third-party cybersecurity agency to investigate the breach and is notifying affected individuals. This incident highlights the persistent security risks faced by major tech suppliers, even when their core systems remain secure, and underscores the critical importance of vetting third-party cloud vendors.