In this article5 sections
Taiwan Semiconductor Manufacturing Company acknowledged that data belonging to some of its current and former employees was released without permission, after a hacker offered more than 46,000 records for sale on an underground forum, AMBCrypto reported on November 12.
The seller set a price of 3 BTC, given as $214.7K, and said the records would be published publicly if payment did not arrive within one week. According to AMBCrypto, the demand was framed as a sale to any buyer rather than a ransom, and no blackmail attempt or equivalent demand had been reported at the time of the original report.
Also read: Adam Back's Bitcoin Treasury Company Seeks to Renegotiate Cantor Fitzgerald SPAC Merger Terms
Key facts
- The hacker claims access to more than 46,000 records linked to a TSMC employee.
- The asking price is 3 BTC, stated as $214.7K, with a one-week deadline before public release.
- TSMC confirmed that data of some current and former employees was disclosed without authorization.
- TSMC said its preliminary investigation found no evidence its security systems were compromised and that the data matched a cloud service provider’s system service.
- TSMC said the data was not associated with any clients or production.
Not a ransomware attack
The incident differs from the classic ransomware pattern in which malware locks a victim out of its own systems. AMBCrypto noted that no malware was used and TSMC was not locked out of its network, which keeps the case in the data-breach category rather than extortion by encryption. TSMC said it was working with cloud service providers and cybersecurity agencies to establish what happened and was taking steps to prevent a repeat.
The chipmaker’s statement that the exposed information sits with a third-party cloud system shifts the immediate question to how that environment was accessed, though TSMC has not said which provider is involved or how the records left it.
A recurring target for extortion
TSMC has faced extortion attempts before. In 2023 the LockBit group targeted the company and sought $70M, a far larger figure than the 3 BTC now on offer. The wider trend has moved against defenders: Black Kite’s ransomware report, cited by AMBCrypto, recorded a 24% year-on-year rise in ransomware disclosures, with active threat groups reaching 127 by the close of one period and 146 by June 2026. Manufacturing accounted for about 22% of all ransomware attacks in that report, and professional, scientific and medical services for a further 18%.
The timing also placed the breach against a separate corporate shock. News of the incident landed as Nvidia dominated coverage after chief executive Jensen Huang resigned following an extramarital scandal, and AMBCrypto noted that IREN, Core Scientific and TeraWulf all fell in trading in the hours after that resignation.
Why it matters
For a company whose business depends on clients trusting it with unreleased chip designs, an employee-data leak that TSMC says touches neither customers nor production is a contained problem rather than an operational one. The reputational pressure still falls on the cloud layer, where a breach at a provider can expose a manufacturer’s staff records without any compromise of the manufacturer’s own network. That distinction matters for how investors and customers read breach disclosures across the semiconductor supply chain, where suppliers, cloud hosts and customers are tightly linked.
What to watch
The one-week payment window set by the seller is the nearest deadline: if it passes unpaid, the records are slated for public release. Also watch for TSMC’s fuller findings with its cloud provider and cybersecurity agencies, and for any identification of the provider involved, which has not been disclosed.
Reported by AMBCrypto.
Source: AMBCrypto