TSMC has disclosed three security incidents in eight years, by our count from its own statements. They are a computer virus in its fabs in 2018, an attack on an IT hardware supplier in 2023 and, on 12 November 2026, employee data that it says matches data held by a cloud service provider. Two of the three TSMC linked to an outside company.
TSMC estimated in October 2018 that the 2018 virus hit third-quarter revenue by about 2% and gross margin by about 1%, while making up about 75% of the affected shipments within the quarter. A seller now claims 46,000 records on current and former staff, United Daily News reported; that equals about 51% of the 90,557 people TSMC employed at the end of 2025, by our arithmetic, a scale comparison only. This explainer sets out each incident, the disclosure rules in Taipei and Washington, and the supplier controls TSMC reports.
Last updated: 12 November 2026. An evergreen explainer; we update it when TSMC or regulators publish new information.
Business Pill · Embedded Dependency
An evergreen Business Engineer explainer on embedded dependency: what is inside what you buy. It teaches the general idea only and does not discuss TSMC.
The key insight: As we read TSMC’s own filings, the risk has moved outward: the 2018 incident started inside its fabs, while the 2023 and 2026 incidents were linked by TSMC to an IT hardware supplier and to a cloud service provider, by our count.
In TSMC’s own words, the 2018 incident was caused by “misoperation during the software installation process for a new tool”. In 2023, a company spokesperson said one of its suppliers, Kinmax, was attacked, The Record reported. In 2026, TSMC’s Form 6-K says the employee information “has been verified to match data stored in the system services of a cloud service provider”.
By our count, that is one incident inside TSMC’s own network and two that TSMC tied to an outside company. The 2026 case is covered in our first report.
TSMC’s three security incidents, 2018 to 2026, as TSMC described them in its 6-K filings and statements (the 2023 statement as The Record quoted it). The count of three, two linked to an outside company, is our own.
2018: A Virus Inside the Fabs
TSMC’s release of 5 August 2018 said a virus outbreak on the evening of 3 August “affected a number of computer systems and fab tools in Taiwan”. It estimated the hit to third-quarter revenue at about three percent and to gross margin at about one percentage point, and said “Data integrity and confidential information was not compromised”.
A second filing on 6 August said the virus was “a variant of the WannaCry virus” and that the tool “was not first isolated and confirmed to be virus-free before connecting to the Company’s computer network”. It put the revenue impact at “no more than two percent” and said “TSMC’s primary computer systems, including production information and customer data, were not affected”.
In October the chief financial officer said the incident “was estimated to have impacted our third quarter revenue and gross margin by about 2 percent and 1 percent respectively”, and that TSMC made up “about 75 percent of the affected shipments in the third quarter”. The estimate fell from about 3% to about 2% within two months, by our reading.
2023: A Supplier’s Server Data
In June 2023 a TSMC spokesperson said the Kinmax attack caused the “leak of information pertinent to server initial setup and configuration”, The Record reported. The spokesperson said the incident “has not affected TSMC’s business operations, nor did it compromise any TSMC’s customer information”.
TSMC said it “immediately terminated its data exchange with this concerned supplier” under its security protocols, the outlet reported. We do not link to any material posted by the group that made claims about the attack.
2026: Staff Data at a Cloud Provider
The 6-K says: “Currently, we have found no evidence that TSMC’s systems have been compromised.” It says the data “is unrelated to the company’s operations or customer-related data” and that TSMC is informing impacted personnel. The filing names neither the provider nor a number of people affected.
The seller’s claims, including 46,000 records and an asking price of 3 bitcoins, about NT$7.4 million, come from United Daily News and have not been confirmed by TSMC. The end-2025 headcount of 90,557 is from TSMC’s 2025 annual report on Form 20-F.
The Disclosure Clock: Taipei vs Washington
In Taiwan, the stock exchange amended item 26 of its material-information rules on 27 April 2021 to name cybersecurity incidents explicitly, iThome reported. A Securities and Futures Bureau official said in 2023 that “failing to reveal relevant information two hours before the trading session the next day will be deemed a violation”, with a fine of between NT$30,000 and NT$5 million, Taiwan News reported.
In the US, the SEC’s 2023 rule says an Item 1.05 Form 8-K “will generally be due four business days after a registrant determines that a cybersecurity incident is material”. Disclosures under it were due from 18 December 2023. Foreign private issuers such as TSMC make “comparable disclosures” on Form 6-K, the release says.
TSMC’s timing: in 2018 the first release came at 16:30 Taiwan time on 5 August, two days after the outbreak and before the next trading session on 6 August, by our reading of the filings. In 2026 it filed with the Taiwan exchange at 13:01 UTC and with the SEC at 13:03 UTC on 12 November, the date of occurrence its Taipei filing gives. That filing cites item 51, not item 26, as our earlier report sets out.
What TSMC Reports on Supplier Controls
TSMC’s 20-F lists “collaborating with major suppliers to improve their security measures” and “conducting supplier security onsite audits” among its cybersecurity measures. It says the Audit and Risk Committee oversees risks from cybersecurity threats.
Its sustainability report says TSMC “achieved an average score of 99 in international third-party information security risk assessments”, that over 90% of key suppliers achieved an A-grade or higher, and that critical suppliers must meet ten key cybersecurity control standards. In November 2022, TSMC said 418 of 639 assessed suppliers had A-level, about 65% by our arithmetic; the two figures cover different groups. Our score analysis has the detail.
The 20-F, filed on 16 April 2026, says that to TSMC’s knowledge there is “no material risk from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of operation or financial condition”. It also says third-party service providers “may also be susceptible to cyberattacks”.
The Structural Read
As we read the 2018 filings, TSMC’s first estimate of about 3% of quarterly revenue came two days after the outbreak and was revised to about 2% within two months, by our reading.
As we read the 20-F, TSMC told US investors in April 2026 that third-party service providers may also be susceptible to cyberattacks, and its 2026 statement ties the leaked staff data to a cloud service provider.
TSMC, Form 6-K filed with the SEC, 6 August 2018
“TSMC will continue to strengthen and strictly implement its standard operating procedures.”
Three Implications
FOR INVESTORS TSMC filed its 2026 statement in Taipei and with the SEC on the same day; its 20-F says it knows of no material risk from cybersecurity threats that has materially affected its business.
FOR SUPPLIERS TSMC’s sustainability report says critical suppliers must comply with ten key cybersecurity control standards.
FOR OTHER CHIP COMPANIES Taiwan’s exchange has named cybersecurity incidents in item 26 of its material-information rules since April 2021, iThome reported.
The framework says: “Enterprise vendors don’t sell software anymore—they sell irreversibility. The product is the interconnection.”
As we read it, each interconnection TSMC adds, a hardware supplier or a cloud service, is also a place where its data sits outside its own network, as the 2023 and 2026 incidents show in TSMC’s own words.
Disclosure deadlines in the US and Taiwan and TSMC’s own timing in 2018 and 2026, from SEC release 2023-139, Taiwan News (2023, quoting an FSC official) and TSMC’s filings. The Taiwan rule is drawn as one day; the US clock runs from a materiality decision, not from the incident.
What Is Not Established
TSMC has not named the cloud provider, given a number of people affected or said how the data left the provider. Whether all 46,000 claimed records are genuine remains to be verified, United Daily News reported. The exchange’s 2025 information security dataset shows TSMC’s line as N/A and does not explain the term. TSMC was not contacted for this explainer.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
By our count from its own statements, TSMC linked two of its three security incidents since 2018 to an outside company: a supplier in 2023 and a cloud service provider in 2026. TSMC estimated the 2018 virus’s impact at about 2% of that quarter’s revenue. In 2026 TSMC filed in Taipei and with the SEC on the same day; the US rule for domestic companies allows four business days after a materiality decision.
A note on sourcing. We read TSMC’s 6-K filings of 5 and 6 August 2018, 18 October 2018 and 12 November 2026, its Taiwan exchange filing of 12 November 2026, the Item 16K and risk-factor text of its fiscal 2025 Form 20-F, its sustainability report and SEC release 2023-139 in full. The 2023 statement is as The Record quoted it; Taiwan’s rules are as iThome and Taiwan News reported them; the seller’s claims are as United Daily News reported them and are unconfirmed. Counts and percentages labelled as ours are our arithmetic. We do not link to leaked data or to anyone offering it.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
