The file that appeared on a dark-web forum this week was named tsmc.txt and held 499 rows, each with 19 fields. Names, national identification numbers, home addresses, phone numbers, email addresses, bank details, job titles, emergency contacts.
It was a sample. The sellers claimed roughly 46,000 employee records, about 6.9 gigabytes of data covering current and former staff, and they listed the haul on forums including DarkForums and BreachForums at a starting price of 3 bitcoin, about $220,000. Buyers were given a week before the full set would be released publicly.
Taiwan Semiconductor Manufacturing Co. confirmed the exposure on Nov. 12. The company said the records came from a third-party cloud system, that its own systems were not breached, and that production operations and customer data were unaffected.
TSMC said it is notifying the individuals affected and is working with the cloud provider, law enforcement and outside security firms. The vendor has not been publicly identified.
For a chipmaker of TSMC’s size, the records themselves are the smaller problem. The company employs tens of thousands of engineers, and its fabs run on processes that customers pay to keep secret. The data described by the sellers covers human resources files, not process recipes or customer designs, and the company’s statement drew that line explicitly.
The larger problem is what the files enable. A list that matches a name to a national identification number, a home address and a bank account is enough to open fraudulent accounts, file false claims or impersonate an employee in a call to a help desk. Security researchers have warned for years that personnel data is the most useful raw material for targeted phishing, because it tells an attacker who reports to whom.
The price says something about the seller’s expectations. Three bitcoin is a small sum for a data set of this size, and a forum listing with a deadline is a retail format, not a negotiation with a corporate victim. The seller appears to be looking for a quick sale to another broker rather than a ransom from TSMC. Data sold once is copied and resold, and a public release becomes likelier as brokers compete on freshness.
TSMC is not the first Taiwanese company to spend a week explaining a breach. The island’s manufacturers have reported a series of incidents in recent years, most of them involving suppliers, contractors or systems that sit outside the corporate perimeter. The pattern is common across manufacturing, where operational technology and office networks were merged for convenience and are audited separately.
The vendor layer is the part that contracts rarely address well. Companies write detailed terms for access to their own systems and thin terms for what a payroll or benefits provider must do when it is breached. Notification windows are often measured in days, which is longer than it takes a forum listing to be indexed and copied.
For TSMC’s customers, the immediate question is whether any of their information sat in the same cloud system. The company said customer data was not affected, which is the answer that matters most to the designers who depend on its fabs. That answer rests on the scope the company has established so far, and investigations of third-party systems often widen. Supply agreements in this industry are among the most closely guarded contracts in manufacturing, and some of the employees named in the files are the ones who schedule them.
For employees, the practical advice is the advice that follows every breach of this kind: expect messages that reference real details. A phishing email that opens with a correct job title, a manager’s name and a phone number is far harder to dismiss than a generic one, and the bank details in the sample make financial fraud plausible.
Taiwan’s personal data protection rules require notification to affected individuals and to the authorities, and the penalties are small relative to the revenue of a company TSMC’s size. Enforcement has focused on the obligation to report rather than on the harm, which is one reason breaches at manufacturers are disclosed in a single paragraph and then drop out of view.
There is a supply-chain reading that the company will resist. TSMC sells trust as much as wafers, and its customers include the largest technology firms in the world, several of which audit their suppliers’ security posture. A breach that begins at a vendor is less damaging than one in a fab, though it weakens the argument that a supplier’s perimeter extends to its contractors.
The question left open is whether a buyer appears before the week is out. If one does, the sample becomes a full release and the affected count becomes public. If none does, the files will still circulate, and the people in them will learn about it from a fraud alert rather than a statement.
