TSMC blames cloud vendor as hackers sell staff data for 3 BTC

The personal data of about 46,000 Taiwan Semiconductor Manufacturing Company (TSMC) staff members has been put up for sale by hackers at auction for around 3 BTC.

TSMC clarified that its systems were not compromised in its Thursday confirmation of the data breach. The chipmaker blamed the incident on an outside supplier.

Almost 7GB worth of 46,000 TSMC employees’ personal data were put up for sale on the DarkForums and BreachForums underground forums by a seller demanding about NT$7.4 million ($220,000) from interested buyers.

The seller opened bidding for one week. If the deadline passes without a deal for the set, they threatened to dump it for free.

How did hackers access TSMC staff data?

TSMC confirmed in a Thursday statement that information about some former and current employees had appeared on external websites without authorization. The Taiwan-based chipmaker also dismissed rumors of an internal system breach, noting that it had found no evidence to support the claim.

The company said that the exposed data, which does not include chip production or customer information, aligns with records held by a cloud service provider.

TSMC said it is already working with the unnamed vendor and with outside cybersecurity firms and investigators to trace the root cause of the breach. It also said it has begun notifying employees who were exposed in the incident.

The company did not confirm the number of people involved.

TSMC reported NT$763.064 billion (US$22.89 billion) in Q3 net profit, mainly driven by revenue from advanced nodes.

What data did the TSMC hacker steal?

To prove the haul was real, the seller released a sample file named “tsmc.txt” containing 499 records, each with 19 fields.

Per reports, the TSMC employee data that the attacker put up for sale includes names, birth dates, job titles, nationalities, national ID numbers, home addresses, personal mobile numbers, and emails. The stolen bank account details led to secondary exposure of employees’ emergency contacts, including names, phone numbers and addresses.

The combination of leaked data is primary fodder for phishing and social engineering attacks for the affected. Then, there is the larger scale issue that the exposed organizational charts could also lead to talent poaching.

The hack at TSMC adds to a recent run of third-party data breaches and fund drains to hit Taiwanese companies, including job bank 104, e-commerce platform 91APP, SinoPac Bank and travel site eztravel.

TSMC has been hacked before

The last such data breach involving TSMC happened in June 2023, when the LockBit ransomware gang demanded $70 million after it listed the company on its leak site. That breach also involved a third-party TSMC IT hardware supplier, Kinmax Technology, whose testing environment leaked server setup files.

Bitdefender reported that LockBit later slashed its demand after apparently realizing it had not touched TSMC itself. TSMC cut data exchange with Kinmax and said customer information was never involved.

Under Taiwan’s Personal Data Protection Act, a firm that contracts out data handling does not shed liability, and affected workers can claim NT$500 to NT$20,00 each, capped at NT$200 million per incident.