TSMC Confirms Employee Data Leak as Hackers Offer 46,000 Records for Bitcoin

TSMC has confirmed a leak of employee data after hackers attempted to sell roughly 46,000 records for bitcoin on underground forums. The world's largest contract chipmaker attributed the exposure to a cloud service provider, but it declined to name the vendor or describe what service that provider handled. That gap matters: without knowing the vector, customers and partners cannot judge whether the fault sits with TSMC's own controls or an external supplier.

Business Next reported that sample records circulated on the forums contained names, national ID numbers, and bank account details. TSMC said affected individuals have already been notified. The company added that it is working with the service provider, cybersecurity firms, and law enforcement to trace where the leak originated.

The confirmation is narrower than the headlines suggest. TSMC has verified the incident, not the full contents of the trove, not the identity of the seller, and not the point of compromise. Readers should treat the 46,000 figure as the criminals' own claim until investigators corroborate it.

How does this fit Taiwan's broader breach wave?

TSMC is the largest name in a cluster of Taiwanese incidents, but not the most damaging by volume. Travel booking platform EzTravel disclosed that data belonging to more than 690,000 customers had been exposed — roughly fifteen times the size of the TSMC employee leak. Bank SinoPac separately reported that attackers exploited its online banking transaction system, producing unauthorized transfers totaling NT$41.76 million.

These are operationally distinct failures. EzTravel's case is a customer-data exposure; SinoPac's is a transaction-system compromise that moved actual funds. TSMC's leak, by contrast, concerns internal employee records. Lumping them together obscures which defenses failed where.

The absence of a named regulator or statutory disclosure deadline in TSMC's statement leaves the enforcement picture unclear. Law enforcement involvement is confirmed; whether Taiwan's authorities will compel the vendor's identity remains an open question.

Are crypto and financial firms facing the same exposure?

Yes, and in several jurisdictions at once. In October, Korean exchange Bithumb disclosed that an outsider gained unauthorized access to one of its internal workplace tools, which may have exposed some customer information. The qualifier "may have" is doing real work there; Bithumb has not confirmed what data was actually taken.

The same wave hit two other Korean financial institutions:

• Daishin Securities reported that information belonging to more than 38,000 customers — names, email addresses, and phone numbers — had been leaked.
• Mirae Asset Global Investment was also affected, though the disclosed scope is smaller.
• South Korea's Financial Supervisory Service (FSS) is investigating all three cases and has sent an on-site inspection team to Daishin Securities.

The FSS response is the most concrete regulatory action in this cluster. An on-site team signals supervisory concern that the firms' own incident handling, not just the breaches themselves, warrants scrutiny.

The pattern has also reached major US crypto firms. A security incident at Amplitude, the third-party analytics provider used by Coinbase, exposed some customer contact information. Coinbase itself was not breached; the failure occurred one step down the supply chain.

What is the common thread?

Nearly every incident in this wave traces to a third party — a cloud vendor, a workplace tool, an analytics provider — rather than a direct break-in at the core company. That is a supply-chain security problem, and it complicates accountability. TSMC, Coinbase, and Bithumb can each say their own perimeter held, while the data still leaked.

For crypto firms, the exposure is more acute than for a chipmaker. Contact details leaked from an analytics vendor feed directly into social-engineering and SIM-swap attacks that target exchange accounts. A name-and-email leak at a brokerage is a nuisance; the same leak at an exchange can be a prelude to account takeover.

The demand for bitcoin payment also fits a known extortion pattern, though no evidence in the reporting suggests TSMC has engaged or will engage with the sellers. Companies rarely confirm ransom negotiations, so silence on that point proves nothing either way.

What happens next?

Expect the FSS to conclude its Korean investigations first, given the on-site inspections already underway. In Taiwan, the open questions are whether TSMC names the cloud provider and whether law enforcement identifies the seller. Until one of those happens, the market cannot assess whether the chipmaker's vendor governance failed or whether it simply inherited a supplier's breach.