Some TSMC employees, past and present, have had their personal details put on a website the company doesn’t control. TSMC says the records line up with data held by one of its cloud providers, and that nothing suggests its own network was broken into.
The company said so in a statement attached to a Form 6-K it filed with the US Securities and Exchange Commission on 12 November. TSMC describes the leaked material as separate from how it runs the business and from anything about its customers.
According to the filing, affected staff are being contacted and offered support. TSMC is now working alongside the cloud vendor, the relevant investigating authorities and an external security firm to establish the facts and decide next steps.
Several basics are still open: which provider held the records, how they got out, which fields were exposed and how many people are affected. The statement names neither the provider nor the website.
The wording matters. TSMC checked the leaked data against what a third-party service stores, which points to that service as the source of the records, yet it stops short of explaining how they left. Until an entry point is named, any claim that attackers got into TSMC’s own systems goes beyond what the company has said.
For the people concerned, the usual danger after such an exposure is a convincing message that appears to come from payroll, a bank or HR and uses genuine details to earn trust. TSMC says it is informing the affected personnel directly.
Senior vice president and chief financial officer Wendell Huang signed the 6-K. It gives no timeline for the investigation.
