TSMC posted its statement on leaked employee data to MOPS, the Taiwan Stock Exchange’s disclosure system, at 21:01 Taipei time on 12 November, which is 13:01 UTC by our arithmetic. It cited item 51 of the exchange’s list of material information. WPG Holdings, which disclosed its own staff data incident about two and a half hours earlier, cited item 26, the item that has named cybersecurity incidents since April 2021.
The exchange’s own information security dataset for 2025, dated 12 November, shows 68 data leak incidents at 19 of the 535 listed companies that gave a figure, by our count. Financial companies logged 59 of them, about 87% by our arithmetic. TSMC’s line for 2025 reads N/A.
Business Pill · Embedded Dependency
An evergreen Business Engineer explainer on embedded dependency: what is inside what you buy. It teaches the general idea only and does not discuss TSMC.
Go deeper: TSMC’s three incidents. TSMC linked two of its three security incidents since 2018 to an outside company, by our count from its own filings, and estimated the 2018 virus at about 2% of that quarter’s revenue; the US rule for domestic companies allows four business days after a materiality decision: Chip Supply-Chain Cyber Risk Explained: TSMC’s 3 Incidents.
The key insight: As we read the two Taipei filings, TSMC put its statement on the leaked staff data under item 51 while WPG Holdings used item 26, the cybersecurity item, and the exchange’s own 2025 data lists 68 leak incidents at 19 companies, 59 of them at financial companies by our count, with TSMC’s line marked N/A.
The filing is signed by TSMC’s spokesperson, chief financial officer Wendell Huang, and gives 12 November as the date of the event. Its fields for the cause and for response measures are both marked not applicable, in our translation.
In its text, in our translation, TSMC says information on some current and former employees was placed on an external website without authorization, and that there is at present no evidence its systems were intruded. It says the information matches data in the system services of a certain cloud service provider and is unrelated to production or customer data.
The Taipei filing came two minutes before the SEC accepted TSMC’s English Form 6-K at 13:03 UTC, by our arithmetic. Neither filing names the cloud provider or gives a number of people affected, as we reported in our first follow-up.
The 68 data leak incidents Taiwan listed companies reported for 2025 in the exchange’s information security data, by company or group: our count and grouping (financial companies = exchange codes 28xx and 5880). TSMC’s 2025 line reads N/A.
Two Filings, Two Items
WPG Holdings, the electronic components distributor, filed at 18:27 Taipei time under item 26, with the subject line, in our translation, that the company had a cybersecurity incident. It said it detected abnormal access to internal systems and confirmed that some employees’ names and work email addresses were accessed without authorization.
WPG said it currently assesses that its finances and business are not affected. Its item-26 filing has fields for possible loss, insurance claims and improvements; TSMC’s item-51 filing has fields for cause and response measures instead.
The exchange amended item 26 on 27 April 2021 to name cybersecurity incidents explicitly; before that, such incidents had been classified as other major matters, iThome reported. TSMC’s filing does not say why it used item 51. Its text says there is no evidence its own systems were intruded.
The Disclosure Clock
A Securities and Futures Bureau official said in 2023 that “failing to reveal relevant information two hours before the trading session the next day will be deemed a violation”, with a fine of between NT$30,000 and NT$5 million, Taiwan News reported. Both filings were posted on the evening of 12 November, before Friday’s session.
What the 2025 Data Shows
The dataset, published by the exchange and the Securities and Futures Bureau, lists 832 companies for 2025. By our count, 516 report zero leak incidents, 19 report at least one, and 297 show N/A, about 36%. The 19 companies list 2,276 affected customers in total.
Cathay Financial Holding lists 20 incidents and CTBC Financial Holding 14. The 11 financial companies with a figure above zero account for 59 of the 68, about 87% by our arithmetic; eight non-financial companies account for 9.
Among chip companies, United Microelectronics and MediaTek report zero. TSMC and WPG Holdings show N/A in all three columns. The dataset does not explain what N/A means, and it covers 2025, before this week’s incidents.
How the Shares Traded
TSMC closed at NT$2,340 on 12 November, down NT$55 or 2.30% by our arithmetic, while the TAIEX fell 2.63%, according to Taiwan Stock Exchange data. The daily figures do not separate any effect of the leak reports from the wider fall.
The Structural Read
As we read TSMC’s filing, its choice of item 51 sits alongside its statement that there is no evidence its own systems were intruded; the filing itself does not explain the choice.
As we read the 2025 data, reported leak incidents cluster at financial companies, while 297 of the 832 companies, about 36% by our arithmetic, show N/A, so the tally describes what companies reported rather than every incident.
TSMC, Form 6-K filed with the SEC, 12 November 2026
“Currently, we have found no evidence that TSMC’s systems have been compromised.”
Three Implications
FOR INVESTORS TSMC closed down 2.30% on 12 November, by our arithmetic, against a 2.63% fall in the TAIEX, per exchange data.
FOR LISTED COMPANIES A Securities and Futures Bureau official said in 2023 that missing the deadline of two hours before the next session could bring a fine of between NT$30,000 and NT$5 million, Taiwan News reported.
FOR AFFECTED STAFF TSMC said in its filing that it has been notifying affected personnel and providing necessary assistance, in our translation.
The framework says: “Salesforce isn’t a CRM; it’s a data layer other systems depend on.”
As we read it, a cloud service holding staff data is such a data layer: TSMC’s filing ties the leaked information to a provider’s systems rather than its own. The framework predates this incident and does not discuss TSMC.
The 832 listed companies in the Taiwan Stock Exchange and Securities and Futures Bureau 2025 information security data, by leak incidents reported: our count from the open data file. The dataset does not explain N/A.
What Is Not Established
TSMC has not named the cloud provider, said how the data was obtained or given a number of people affected in either filing. Neither filing says why each company chose its item.
The 68 incidents are what companies reported in the 2025 dataset, not a count of exchange filings. Our grouping of financial companies uses exchange codes. We did not contact TSMC or WPG for this piece; the original leak report sets out the seller’s claims, which TSMC has not confirmed.
This Week In The AI Supercycle
The Great Convergence of Capital, Power, and Geopolitics
This week’s issue: for two years the AI build-out was priced as a supply story, and last week as a credit story. This week it was priced as a permission story, and the answer arrived as a cost, not a ban.
TSMC filed its staff data statement with the Taiwan Stock Exchange under item 51 at 21:01 Taipei time, while WPG Holdings filed its incident under item 26, the cybersecurity item. The exchange’s 2025 dataset shows 68 leak incidents at 19 listed companies, 59 of them at financial companies by our count, with TSMC’s line marked N/A.
A note on sourcing. TSMC’s and WPG Holdings’ statements come from their material information filings on the Taiwan Stock Exchange’s MOPS system, read in full in Chinese; translations are ours. The 2025 leak figures are our count from the exchange and Securities and Futures Bureau open data file (reporting year 2025, table dated 12 November 2026); the grouping of financial companies by exchange code is ours.
The item 26 amendment is from iThome, the disclosure clock and fines from Taiwan News, and share prices from Taiwan Stock Exchange data. Percentages are our arithmetic. We did not view the data on offer, and neither company was contacted for this piece.
Gennaro Cuofano is a CRO and tech executive who has worked in AI since late 2015, starting with bringing NLP, natural-language generation, voice and chatbot products to the marketing industry. His background is in law and finance: he holds a Master's degree in Law and an International MBA with an emphasis on corporate finance (LUISS Business School and the University of San Diego, 2012), and worked as a financial analyst at a real-estate investment firm in San Diego and as an assistant controller. His work focuses on business model strategy, business engineering and, more broadly, structural analysis: how companies make money, read from their own filings. He created FourWeekMBA and leads research there and at The Business Engineer, his newsletter on AI and business strategy, with over 95,000 subscribers and more than 1,000 published analyses. His writing has also appeared on Entrepreneur (for example, How to Digitize a Family Business in Europe) and HackerNoon. Find him on LinkedIn and Substack. See how we source.
