Taiwan Semiconductor Manufacturing Company has confirmed that personal data belonging to current and former employees was exposed on an external website without authorization — a breach that, according to multiple news reports, involves roughly 46,000 records offered for sale by a hacker demanding 3 Bitcoin.
The company disclosed the incident in a statement filed with the US Securities and Exchange Commission on November 12, 2026, signed by Senior Vice President and Chief Financial Officer Wendell Huang. TSMC is the world's largest contract chipmaker and manufactures the advanced processors at the heart of the AI boom, which is why even a breach of employee data — and not customer or manufacturing data, the company stresses — reverberated through the technology industry. For more context on this story, see our ongoing AI trends.
What TSMC's SEC filing actually says
The filing is unusually specific for a security disclosure. TSMC's statement, titled "Statement Regarding the Unauthorized Access of Employee Personal Data," reads in part:
> "TSMC has found that some of our current and former employee data was made available on an external website without authorization. Currently, we have found no evidence that TSMC's systems have been compromised. This information has been verified to match data stored in the system services of a cloud service provider, but is unrelated to the company's operations or customer-related data."
The company said it has been informing impacted personnel and providing support, and that it has engaged "both the cloud service vendor, the relevant investigating authorities, and a third-party cybersecurity agency to jointly ascertain the facts and take necessary actions."
In plain terms: the data did not leak from TSMC's own networks. It matched records held by a third-party cloud provider's systems — a supply-chain exposure, not a direct intrusion into the chipmaker.
The ransom claim: 46,000 records for 3 Bitcoin
While TSMC's filing does not quantify the exposed data, multiple outlets reported the scale and the price tag. Moneycontrol reported that hackers claimed 46,000 employee records and demanded roughly $220,000 — about 3 Bitcoin. Chosunbiz reported that a hacker advertised 46,000 TSMC employee records for sale following the cloud leak, and coverage picked up by Cryptonews described the data going up for auction at 3 BTC while noting what it called Taiwan's pile-up of supply-chain breaches. FourWeekMBA reported the trove at approximately 6.9 GB, with the demand variously cited around NT$7.4 million.
These figures originate from the seller's own claims and press aggregation rather than from TSMC, which has not confirmed the record count, file size, or ransom demand. What the company has confirmed is narrower and more important: current and former employee data was exposed, the source was a cloud service provider's systems, and neither its operations nor customer data were involved.
Why it matters even when fabs are fine
TSMC told outlets that its manufacturing systems were unaffected, and the SEC statement draws a bright line between the exposed employee records and "the company's operations or customer-related data." For the AI industry, that distinction is the whole story: the fabrication lines producing Nvidia's accelerators and other frontier AI chips were not touched.
Still, the incident introduces real exposure of a different kind, as GuruFocus observed in its coverage: privacy and regulatory risk for a company central to the global AI supply chain. Employee data breaches trigger notification obligations across jurisdictions, and a listed company confirming an incident in an SEC filing invites questions from investors about vendor risk management — questions that will now follow TSMC's next earnings cycle.
The structural lesson is the one security teams have been repeating for a decade: your defenses are only as good as your vendors' data practices. The most sophisticated chipmaker on the planet lost control of employee records not through its own systems, but through a service provider holding its data.
One more bruise in a turbulent week
The disclosure landed during an already chaotic stretch for technology infrastructure. The same day, Microsoft was struggling to restore a global outage of Microsoft 365 services including Outlook and Teams, and Nvidia announced that longtime CEO Jensen Huang had resigned — front-page news across the industry. One technology news roundup described November 12 as "a turbulent day for the global technology industry," with TSMC's confirmation of the data leak arriving in the middle of it.
There is no suggested connection between the events, but the coincidence illustrates the environment enterprise security teams operate in: several of the world's most critical technology companies managing high-profile failures and disclosures within a single news cycle.
What happens next
TSMC says it is working jointly with the cloud vendor, investigating authorities, and an outside cybersecurity agency to establish the facts. Employees whose data was exposed are being notified and offered support, which in Taiwan's context may carry regulatory follow-through under the island's personal data protection regime.
Watch three threads as this develops: whether the attacker's claims about the dataset's size and contents are validated or debunked by investigators; what the forensic review of the cloud service provider reveals about how the data left its systems; and whether TSMC's vendor management practices — and those of other Taiwanese tech giants, which have faced a series of breaches — draw regulatory scrutiny. For an industry racing to supply the AI boom's compute, the episode is a reminder that the supply chain's attack surface extends well beyond the fab floor.
---
Stay Ahead of AIGet the latest AI news, analysis, and breakthroughs — all in one place.
Read more AI news →
