Taiwan Semiconductor Manufacturing Co. has confirmed that personal data belonging to some current and former employees was disclosed without authorization after an apparent exposure linked to a third-party cloud service provider.

The confirmation followed reports that an unknown seller had listed what they described as 46,000 TSMC employee records for sale on an underground forum. The seller claimed to hold a 6.9 GB archive and asked for 3 BTC, while warning that the full dataset would be released within a week if no buyer emerged.

Sale offer appeared on underground forum

According to local media reports cited by Taiwan's Central News Agency and TVBS, the alleged database was advertised on a darknet or underground forum. The person behind the listing claimed the archive contained employees' personal information and set the asking price at 3 BTC.

Local media estimated that amount at roughly 7.4 million New Taiwan dollars. The seller also threatened to publish the archive in full if it was not purchased within a week. However, the full authenticity of the records and the claimed scale of the leak have not been independently verified.

TSMC says its own systems show no sign of intrusion

In its statement, TSMC said the exposed information corresponds to data held in the system of one of its third-party cloud providers. The company did not identify the provider by name.

TSMC also said it has not found evidence that its own internal information systems were breached. It added that the incident did not involve customer information or data related to production processes, narrowing the scope of what the company says was exposed.

Company has started notifications and outside coordination

The chipmaker said it has begun informing affected current and former employees and is providing what it described as necessary assistance. At the same time, it is working with the cloud service provider involved, law enforcement authorities, and independent cybersecurity experts to establish how the incident happened.

That response suggests the investigation is still at an early stage. TSMC has not said whether it has identified the person offering the data for sale, and it has not provided a final count of how many employees were affected.

Key unknowns remain

Several important details were still unresolved at the time of publication. TSMC had not explained how the attacker obtained the information, and the company had not confirmed whether the full set of allegedly 46,000 records is genuine.

For now, the next confirmed step is the ongoing investigation with the third-party provider, law enforcement, and external cybersecurity specialists. Further updates are likely to focus on the source of the exposure, the final number of affected people, and whether any additional data is verified as part of the leak.

Source: incrypted.com