TSMC said in its latest sustainability report that in 2025 it “achieved an average score of 99 in international third-party information security risk assessments, ranking within the top 1% of the technology industry”. On 12 November it told the US Securities and Exchange Commission that some current and former employee data had been put on an external website and matches data held by a cloud service provider.
Update, 12 November. Taiwan-listed WPG Holdings (TWSE: 3702) disclosed a security incident in a stock-exchange filing on the same day. It said in the filing (filing text via MoneyDJ) that it had detected abnormal access to internal systems and confirmed that some employees’ names and work email addresses were accessed without authorization. It said it assessed no impact on its finances or business operations, told all staff to watch for scams using the data and is strengthening monitoring. The Liberty Times (report) linked the filing to the TSMC staff-data report.
The same report says over 90% of TSMC’s key suppliers reached an A grade or higher in third-party assessments in 2025. In November 2022 TSMC said 418 of the 639 suppliers it had assessed held A-level, about 65% by our arithmetic. The two figures cover different groups, so they are not a like-for-like comparison.
Business Pill · Least Privilege
An evergreen Business Engineer explainer on least privilege: giving a system only the access its task needs. It teaches the general idea only and does not discuss TSMC.
The key insight: As we read TSMC’s own disclosures, the company reported an average score of 99 in third-party information security risk assessments, top 1% of the technology industry, and reported over 90% of key suppliers at an A grade, yet its 12 November filing ties the leaked staff data to a cloud service provider rather than to its own systems.
TSMC filed the statement on a Form 6-K signed by its chief financial officer, Wendell Huang; the SEC system shows it accepted at 08:03 US Eastern time, which is 13:03 UTC by our arithmetic. It sets out in English the statement we reported earlier today from Chinese-language reports.
The filing says: “Currently, we have found no evidence that TSMC’s systems have been compromised.” It says the information “has been verified to match data stored in the system services of a cloud service provider” and is unrelated to the company’s operations or customer-related data.
TSMC said it is informing affected personnel and working with “the cloud service vendor, the relevant investigating authorities, and a third-party cybersecurity agency”. The filing does not name the provider or give a number of people affected.
Share of TSMC suppliers at an A grade or higher in its own third-party security assessments: 418 of 639 assessed suppliers in November 2022 (about 65%, our arithmetic), per a TSMC ESG article, and over 90% of key suppliers in 2025, per TSMC’s sustainability report. The two figures cover different groups and are not a like-for-like comparison.
What TSMC’s Own Report Measured
The information security chapter of TSMC’s sustainability report lists its 2025 actions. TSMC says it completed 17 cybersecurity incident drills across domestic and overseas sites and continued cybersecurity insurance coverage to mitigate cybersecurity risks.
Among the actions marked new for 2025, the report lists stronger management of high-risk access privileges, “with comprehensive governance over high-risk domains and cloud services”. It says audits found no major security incidents resulting in breaches, customer information leaks or fines in that year.
For suppliers, TSMC says it evaluates cybersecurity scores through a third-party security platform and requires critical suppliers to comply with ten key cybersecurity control standards, including computer equipment management and malware protection. It also says it set up a supplier threat intelligence notification mechanism.
The Supplier Figures
TSMC set up a supplier information security assessment team in 2021 and added third-party evaluation of suppliers in February 2022, according to a 2022 TSMC sustainability article. By November 2022 it had assessed 639 suppliers; 418 had A-level and 221 did not, by our arithmetic.
By 2025 the report puts the share of key suppliers at an A grade or higher at over 90%. TSMC’s 6-K says the leaked employee data matches data held by a cloud service provider; neither the filing nor the report says whether that provider is among the suppliers TSMC scores.
This is the second time since 2023 that TSMC has tied an incident to an outside company. In 2023 it said an IT hardware supplier, Kinmax, was attacked, and that it had cut off data exchange with that supplier, The Record reported.
What the Seller Claims
The seller claims 46,000 records of 6.9GB and asks 3 bitcoins, about NT$7.4 million, United Daily News reported. TSMC’s 6-K does not confirm the record count. We did not open or link the sale listing.
The Structural Read
As we read the 6-K and the report together, TSMC’s scoring covers its own systems and the suppliers it assesses; the filing does not say whether the cloud provider was among them.
As we read the 2022 and 2025 figures, the about 65% of all assessed suppliers in 2022, by our arithmetic, and the over 90% of key suppliers in 2025 measure different groups and are not a like-for-like comparison.
TSMC, Form 6-K filed with the SEC, 12 November 2026
“We remain firmly committed to protecting employee privacy and safeguarding data security.”
Three Implications
FOR AFFECTED STAFF TSMC said in its 6-K that it has been informing impacted personnel and providing them with necessary support.
FOR TSMC’S VENDORS TSMC’s report says it requires critical suppliers to comply with ten key cybersecurity control standards.
FOR CUSTOMERS TSMC’s 6-K says the data is unrelated to the company’s operations or customer-related data.
The framework says: “Enterprise vendors don’t sell software anymore—they sell irreversibility. The product is the interconnection.”
As we read it, a company can score its own systems and its key suppliers, but the interconnection with a cloud service it relies on sits partly outside that score. The framework predates this incident and does not discuss TSMC.
The 639 suppliers TSMC had assessed for information security by November 2022, per a TSMC ESG article: 418 at A-level and 221 below, by our arithmetic.
What Is Not Established
TSMC has not named the cloud provider, said how the data was obtained or given a number of affected people in the filing we read. The 99 score and the supplier grades are TSMC’s own disclosures from its report, and the chapter we read does not name the firms that ran the assessments.
The 65% and over-90% figures measure different groups: all 639 suppliers assessed by November 2022 and the key suppliers counted in 2025. We did not contact TSMC for this piece.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
TSMC disclosed that it achieved an average score of 99 in third-party information security risk assessments in 2025, top 1% of the technology industry, and that over 90% of key suppliers reached an A grade or higher. Its 12 November SEC filing says the leaked employee data matches data held by a cloud service provider, and that it has found no evidence its own systems were compromised.
A note on sourcing. TSMC’s statement comes from its Form 6-K filed with the SEC on 12 November, read in full. The 2025 score, supplier grades and actions come from the information security chapter of TSMC’s sustainability report, and the 2022 supplier figures from a TSMC ESG article of 16 November 2022, both read in full. The seller’s claims come from United Daily News, read in Chinese; the 2023 supplier incident from The Record. Ratios are our arithmetic. We did not view the data on offer, and TSMC was not contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
