TSMC "Extorted" for 3 Bitcoin, Hackers Sell 6.9GB of Employee Data on Dark Web: Yet Another Familiar Supply Chain Attack?

No matter how high the intranet wall is built, it cannot block backdoors left by service providers.

Author: Curry, TechFlow

Editorial: On November 12, hackers publicly listed for sale on underground forums what they claimed was 6.9GB of data belonging to TSMC, covering the personal information of approximately 46,000 employees. The asking price was set at 3 Bitcoin (approximately NT$7.4 million), with a threat to publicly release the entire dataset online if no one took over within a week. TSMC issued a statement the same day confirming that some records of current and former employees had indeed been leaked, but stressed that its own systems were not compromised. The incident originated from the system of a cooperating external cloud service provider, and did not involve wafer fabrication processes or client trade secrets. This indicates that hackers' extortion tactics have once again bypassed the semiconductor giant's formidable internal network firewalls, instead exploiting supply chain vulnerabilities that are more difficult to secure.

The tightest security barrier in the global semiconductor supply chain has once again been breached at the external supplier stage.

According to reports from Business Weekly and CNA Taiwan on November 12, hackers posted on dark web forums such as DarkForums and BreachForums, claiming to have obtained internal data from wafer foundry giant TSMC. The files total 6.9GB and contain approximately 46,000 employee records. The hackers offered an outright buyout price of only 3 Bitcoin, which translates to roughly NT$7.4 million (approximately $220,000 USD) at current market rates. The poster simultaneously set a one-week countdown, threatening to publicly release all the data for free if no one purchases it by the deadline.

46,000 Records Priced Out, Hackers Release Sample with 19 Detailed Fields

To prove the authenticity of the data to potential buyers, the hackers published a sample file named "tsmc.txt" on the forum.

According to Taiwan's Wind News citing the sample content, the published sample contains 499 personnel records, each comprising 19 detailed fields. Beyond basic information such as employee names, dates of birth, job titles, nationalities, and ID numbers, it also meticulously lists home addresses, private mobile phone numbers, email addresses, bank account details, and even the real names, phone numbers, and addresses of emergency contacts.

Experts from the Taiwan Information Security Association (TWISA) told Business Weekly that once organizational structures and private information from core technology companies are leaked, the immediate threats are targeted phishing and social engineering fraud. Criminals can easily impersonate HR staff or managers to contact employees' family members. The longer-term impact involves intelligence gathering and poaching of key talent critical to advanced semiconductor manufacturing processes.

TSMC Traces Breach to External Cloud Provider, Core Processes and Client Data Remain Unaffected

In response to the sudden data breach, TSMC quickly stepped forward to set the narrative on the afternoon of November 12.

According to an official statement released by TSMC, the company immediately activated its emergency response protocol upon discovering that some current and former employees' information had been posted without authorization on external websites. TSMC explicitly stated that as of now, there is no evidence suggesting that its own internal IT systems or wafer manufacturing equipment have been hacked.

The statement further noted that preliminary cross-referencing indicated the leaked content matched data in the services of a cooperating cloud service provider. Furthermore, this batch of materials completely excludes TSMC's chip production operations and client-related data. Currently, TSMC has been providing assistance to affected employees and is collaborating with the involved cloud service provider, judicial investigation authorities, and third-party professional cybersecurity firms to conduct investigations.

Business Week pointed out in its industry analysis that TSMC implements highly stringent physical-level network isolation between operational technology (OT) for factory plants and corporate IT networks. In Q3 2026, TSMC's quarterly net profit reached NT$763.064 billion, with advanced process revenues accounting for a high of 79%. Its core manufacturing fundamentals were not directly damaged in this incident.

Supply Chain Once Again Proves the Weakest Link, Hacker Extortion Fully Shifts to External Outsourcing Chains

This is not the first time TSMC has been drawn into a hacker extortion wave targeting external partners.

Public records show that in June 2023, the notorious ransomware group LockBit listed TSMC as a victim on its dark web site, demanding a massive ransom of $70 million. Subsequent investigations at the time confirmed that the actual target of the cyberattack was Kinmax, TSMC's hardware equipment supplier. Only initial configuration files for the shipping test environment were leaked, and TSMC's own network remained secure.

Three years later, the script has played out again, with the attack target shifting from hardware outsourcing vendors to cloud application providers.

Cybersecurity industry observers point out that modern large multinational corporations invest massive security budgets at their network perimeters, making attacks on core data centers extremely difficult. Consequently, cybercriminals' strategies have fully shifted, targeting outsourced HR systems, third-party collaboration tools, and APIs and configuration vulnerabilities in external cloud service platforms. For a wafer giant with annual revenues in the trillions of New Taiwan dollars, the hacker's asking price of 3 Bitcoin may seem small in amount, but it carries immense reputational damage.

For TSMC's current and former employees, the coming months require vigilance against disguised phishing and precision fraud lurking in the shadows. For the broader semiconductor industry, this listing serves as another wake-up call: no matter how high the internal network walls are built, they cannot block the backdoors left by third-party service providers.

Join the official Coincamps community:

X: https://x.com/coincamps

Telegram: https://t.me/coin_camps