TSMC has confirmed that personal information belonging to some current and former employees was exposed through an external cloud service provider, following reports that hackers obtained thousands of employee records.
The Taiwanese semiconductor manufacturer said its internal systems had not been compromised and that the exposed information was unrelated to its manufacturing operations or customer data.
According to reports from Taiwan, hackers claim to possess approximately 6.9GB of information covering tens of thousands of TSMC employees. They have reportedly demanded three Bitcoin in exchange for not releasing the stolen information publicly.
The incident has raised concerns about employee privacy, particularly because the alleged stolen records contain sensitive personal and financial details.
TSMC is now working with the affected cloud provider, investigating authorities and cybersecurity specialists to determine the extent of the breach.
Hackers Claim to Have Stolen Thousands of TSMC Employee Records
The incident came to light after hackers reportedly advertised the stolen information on underground online forums.
According to the claims, the compromised data includes approximately 46,000 employee records, although the exact number of affected individuals has not been independently confirmed.
The attackers also published a sample file named tsmc.txt, reportedly containing information about 499 employees.
The sample allegedly includes residential addresses, bank account numbers and emergency contact details.
Such information can be valuable to criminals attempting phishing attacks, financial fraud or identity theft.
For example, attackers could use an employee's personal details to create convincing messages impersonating financial institutions, employers or other trusted organizations.
The hackers have reportedly demanded three Bitcoin as ransom and threatened to release the information if their demand is not met.
However, TSMC has not confirmed the total number of stolen records or whether the attackers possess all the information they claim.
TSMC Says Its Internal Systems and Customer Data Remain Unaffected
TSMC has acknowledged that some employee information appeared on an external website without authorization.
Following an initial investigation, the company determined that the exposed information matched records stored by an external cloud service provider.
TSMC emphasized that investigators had found no evidence of unauthorized access to its own internal systems.
The company also stated that the affected information was unrelated to production operations or customer records.
This distinction is particularly important given TSMC's position as a leading semiconductor manufacturer supplying advanced chips to major technology companies.
Its manufacturing technologies, including advanced process nodes and packaging solutions such as CoWoS, represent highly valuable intellectual property.
However, the company's current findings do not indicate that those technologies or related trade secrets were exposed.
The investigation remains ongoing, so its conclusions could change if additional evidence emerges.
TSMC Is Contacting Affected Employees and Investigating the Breach
TSMC has begun notifying impacted personnel and providing assistance to those affected.
The company is also coordinating with the cloud service provider responsible for storing the information.
External cybersecurity specialists and relevant investigating authorities have been brought in to examine the incident and determine what happened.
The investigation will likely focus on how the attackers obtained access to the information and whether additional records were exposed.
TSMC has not publicly identified the affected cloud provider or disclosed the technical cause of the breach.
TSMC Previously Faced a Supplier Related Ransomware Incident
This is not the first time a cybersecurity incident involving an external supplier has affected TSMC.
In 2023, a ransomware group reportedly compromised one of the company's hardware suppliers and demanded approximately $70 million.
The latest incident again highlights the potential risks associated with storing sensitive corporate information through third party services.
Even when a company's internal systems remain secure, weaknesses in an external provider can expose personal information entrusted to that organization.
For affected TSMC employees, the immediate concern is the potential misuse of their personal and financial information.
TSMC maintains that its manufacturing systems and customer data remain unaffected, but the company has not yet disclosed when its investigation will be completed or how many individuals were ultimately impacted.
Discussion (0)
Be the first to comment.