{
  "id": "tsmc-employee-data",
  "url": "https://ohshit.app/incidents/tsmc-employee-data/",
  "title": "TSMC confirms employee data appeared on an external website",
  "level": 3,
  "level_name": "sharted",
  "date": "2026-11-12",
  "date_is_approximate": false,
  "updated": null,
  "tags": [
    "TSMC",
    "employee data",
    "cloud"
  ],
  "ecosystems": [],
  "summary": "TSMC says some current and former employee data was posted without authorization and matched records held by a cloud provider. The company is notifying affected people. It has not disclosed the provider, the exposed fields, a victim count or the access path.",
  "splash": "Some current and former TSMC employees whose information appeared on an external website.",
  "wipe": "Verify any notice through a known TSMC HR contact and ask which fields were exposed and what support is available.",
  "in_the_wild": "yes",
  "source_exception": null,
  "cves": [],
  "fixed": [],
  "checklist": [
    {
      "title": "Verify notices and ask about your own records",
      "hint": "Use an established TSMC HR or security contact to confirm the message, ask which fields were involved and obtain the support described in the filing."
    },
    {
      "title": "Report suspected impersonation",
      "hint": "Verify unexpected payroll or benefits requests separately before replying. Preserve messages and headers and report them through an established company channel."
    }
  ],
  "sources": [
    {
      "name": "TSMC Form 6-K filed with the SEC",
      "url": "https://www.sec.gov/Archives/edgar/data/1046179/000104617926000800/a20261112statementregardin.htm",
      "says": "Confirms the unauthorized posting, cloud record match and notification effort.",
      "primary": true
    }
  ],
  "headline": null,
  "one_liner": null,
  "in_the_wild_note": "TSMC confirms unauthorized publication of employee information.",
  "mitigation": null,
  "timeline": [
    {
      "date": "Nov 12, 2026",
      "title": "TSMC discloses the exposure in a Form 6-K",
      "body": "The company is notifying affected people and working with the cloud provider, authorities and external security specialists."
    }
  ],
  "body_markdown": "TSMC says its investigation found no evidence that its own systems were compromised and says the information was unrelated to operations or customer data. The filing identifies where matching records were held. The provider and the route used to obtain the records remain unknown. It also gives no verified number of records or people. L3 reflects confirmed external exposure at a major employer with the scale still unknown."
}