TSMC Employee Data Sold on Dark Web for 3 Bitcoin; Company Confirms Leak, Denies System Breach

Hackers Claim to Possess TSMC Employee Data, Company Confirms Partial Leak

Hackers are reportedly offering personal data of 46,000 Taiwan Semiconductor Manufacturing Company (TSMC) employees on underground forums, with an asking price of 3 Bitcoin. TSMC has confirmed that some employee data has been leaked but stated there is no evidence of its own systems being compromised.

TSMC’s official statement indicates that while employee data has indeed been leaked, there is currently no indication that the breach originated from its internal systems. The leaked information includes data from both current and former employees. Upon comparison, TSMC found the content to be consistent with data stored by a third-party cloud service provider. The company emphasized that its wafer production and customer data were not part of this leak.

In a comprehensive response issued on December 12th, TSMC clarified its position: “Currently, there is no evidence to suggest that TSMC’s systems have been compromised.” Affected individuals are being notified sequentially.

The incident began with posts on two underground forums, DarkForums and BreachForums, where individuals claimed to possess records of 46,000 TSMC employees, totaling 6.9GB. The initial bid was set at 3 Bitcoin, with a threat to release the data publicly within a week if not sold. At the afternoon exchange rate on December 12th, 3 Bitcoin was valued at approximately NT$7.26 million (about US$220,000).

To substantiate their claims, the sellers provided a sample file named “tsmc.txt,” containing 499 records, each with 19 fields. According to the sellers, the data includes names, national identification numbers, bank information, addresses, mobile numbers, email addresses, birthdates, job titles, and nationalities. Even emergency contact information, including phone numbers and addresses, was reportedly included.

However, it is crucial to note that these details are based on the hackers’ assertions. TSMC has only acknowledged a “partial” leak of employee data. The accuracy of the 46,000-record figure and the completeness of the sample remain unverified by independent sources. TSMC has not yet disclosed the exact number of affected individuals, the identity of the cloud service provider, or the specific method of the data exfiltration.

Cybersecurity experts have assessed that information such as names, job titles, and company affiliation could be used to impersonate HR personnel or management to send out false notifications. The combination of mobile numbers and email addresses could facilitate phishing attacks or the creation of fake account verification processes. The inclusion of national identification numbers and bank details raises concerns about identity theft and financial fraud.

The inclusion of emergency contact information presents a particularly challenging aspect to defend against. Scammers could bypass direct contact with employees and instead impersonate company HR to inform family members of an incident involving the employee, or use AI-generated deepfakes to impersonate the employee and solicit funds from their relatives. A recommended precautionary measure is to hang up on any calls claiming to be from TSMC HR reporting an employee incident and to independently verify the information by contacting the individual or the company directly.

Experts also caution that the leaked data may not be used immediately. It could be resold or cross-referenced in the underground market, with fraudulent activities potentially surfacing months later.

This is not the first time TSMC has faced such a situation. In June 2023, the ransomware group LockBit listed TSMC on its dark web leak site, demanding $70 million. The actual breach at that time affected Kinmax, an IT service provider in Hsinchu, with the leaked data primarily consisting of server initial configurations and setup information. TSMC stated then that no customer data was compromised and suspended data exchange with the supplier.

A clear commonality in both incidents is that TSMC has stated its own systems were not compromised, with the issues stemming from external vendors. Taiwan’s recent Yong Feng Bank fund transfer fraud case also involved a similar explanation, with the bank’s chairman apologizing and stating that hackers gained access through a supplier’s system.

In summary, TSMC appears to have maintained the security of its wafer fabrication plants and customer data, with no counter-evidence presented thus far. However, the storage of employee data on third-party systems is an area TSMC cannot directly control, relying instead on contractual agreements and audits to enforce compliance. If the cloud service provider is ultimately identified as the source of the leak, it would point to a supply chain management issue rather than a breach of the fabrication plant’s defenses. Conversely, if evidence emerges of data exfiltration through other internal channels, it would necessitate a serious re-evaluation of the company’s internal cybersecurity measures.