TSMC confirmed on 12 November that information on some of its current and former employees was placed on an external website without authorisation, United Daily News reported. The company said the data matches data held in the systems of a certain cloud service provider and that there is no evidence its own systems were breached. A hacker is asking 3 bitcoins, about NT$7.4 million, for what it claims are 46,000 records.
TSMC said the data does not involve production or customer information. The 46,000 records the hacker claims equal about 55% of the 83,825 people TSMC employed at the end of 2024, by our arithmetic; the records cover current and former staff, and TSMC has not confirmed the count.
Business Pill · Concentration
An evergreen Business Engineer explainer on concentration: when a few big pieces make the total. It teaches the general idea only and does not discuss TSMC.
The key insight: As we read TSMC’s statement, the exposure sits outside the fab: the company says the data matches what a cloud service provider held and is unrelated to production or customers, yet the seller’s claimed 46,000 records equal about 55% of TSMC’s end-2024 headcount, by our arithmetic.
TSMC said a preliminary review found the information matches data in the system services of a certain cloud service provider, according to United Daily News and ETtoday, which carried the same statement. The quotes here are our translation from Chinese.
The company said it has been notifying affected people in stages and providing necessary assistance. It said it is working closely with the cloud service provider, investigative authorities and third-party cybersecurity organisations to clarify the cause and take necessary measures.
United Daily News reported that TSMC has not disclosed the number of people affected or the name of the cloud service provider. It reported no evidence at this stage that wafer production or customer orders were directly hit.
Records a seller claims to hold on current and former TSMC employees (46,000, as reported by United Daily News and ETtoday and not confirmed by TSMC) against the 83,825 people TSMC employed worldwide at the end of 2024, per its 2024 annual report. The 55% ratio is our arithmetic and is a scale comparison only, because the records include former staff.
What the Seller Claims
Both outlets reported that the seller claims 6.9GB of data and threatened to release it in full if no buyer is found within a week. ETtoday put the 3-bitcoin asking price at about NT$7.3 million to NT$7.4 million.
United Daily News reported that a sample file with 499 records of 19 fields each was released, reportedly covering names, dates of birth, job titles, national ID numbers, addresses, phone numbers, email and bank information. It said whether all 46,000 records are genuine remains to be verified.
Third Incident in Eight Years
This is the third TSMC-related security incident in eight years that we count from the company’s own statements, and the second that TSMC has linked to a third party. On 3 August 2018 TSMC had a computer virus incident: its third-quarter 2018 release said the incident cut that quarter’s revenue and gross margin by about 2 percent and 1 percent respectively.
In 2023 TSMC said an IT hardware supplier, Kinmax, was attacked, causing the “leak of information pertinent to server initial setup and configuration”, The Record reported. TSMC said then that it had immediately terminated its data exchange with that supplier. The 2026 incident involves employee personal data rather than system configuration data, per TSMC’s statement.
TSMC shares closed down 55 New Taiwan dollars at 2,340 on 12 November, ETtoday reported, on a day the Taiwan market closed down 1,165 points; we covered the session separately and do not attribute the move to this incident.
The Structural Read
As we read the two incidents together, TSMC said in 2023 that a supplier leak involved server setup and configuration information, while the 2026 statement concerns personal information on current and former employees, according to United Daily News.
As we read the reports, the open questions are the ones TSMC has not yet answered: how many people are affected, which cloud provider is involved and how the data was obtained, which United Daily News says remain under investigation.
TSMC spokesperson on the 2023 Kinmax supplier incident, as reported by The Record, 30 June 2023
“Upon review, this incident has not affected TSMC’s business operations, nor did it compromise any TSMC’s customer information”
Three Implications
FOR AFFECTED STAFF TSMC said it has been notifying affected people in stages and providing necessary assistance, United Daily News reported.
FOR TSMC’S VENDORS TSMC said it is working with the cloud service provider, investigative authorities and third-party cybersecurity organisations to clarify the cause.
FOR CUSTOMERS TSMC said the data does not involve production or customer-related information.
The framework says: “Enterprise vendors don’t sell software anymore—they sell irreversibility. The product is the interconnection.”
As we read it, a cloud provider holding employee records is part of that interconnection, and its security becomes the customer’s exposure. The framework predates this incident and does not discuss TSMC.
TSMC’s 83,825 employees at the end of 2024 by role, per its 2024 annual report: professionals 40,477, technicians 24,404, assistants 10,207 and managers 8,737. Shares are our arithmetic.
What Is Not Established
TSMC has not confirmed how many people are affected, which cloud provider holds the matching data, or how the data was obtained, according to the reports we read. The 46,000 figure and the 6.9GB size are the seller’s claims as reported by the two outlets. We did not open or link the sale listing.
The 55% comparison uses TSMC’s 2024 annual report headcount; the leaked records include former employees, so it is a scale comparison, not a share of staff affected. We did not contact TSMC for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
TSMC said a preliminary review found the leaked employee data matches data held by a cloud service provider and that there is currently no evidence its own systems were breached. The seller’s claimed 46,000 records equal about 55% of TSMC’s end-2024 workforce, by our arithmetic, and it is the second incident since 2023 that TSMC has linked to a third party.
A note on sourcing. TSMC’s statement and the seller’s claims come from United Daily News and ETtoday reports of 12 November, read in full in Chinese; quotations from them are our translation. The 2023 supplier incident comes from The Record; the 2018 figures come from TSMC’s third-quarter 2018 release; headcount comes from TSMC’s 2024 annual report. Ratios are our arithmetic. We did not view the data on offer, and TSMC was not contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
