TSMC confirms employee data appeared on an external website
TSMC says some current and former employee data was posted without authorization and matched records held by a cloud provider. The company is notifying affected people. It has not disclosed the provider, the exposed fields, a victim count or the access path.
- Disclosed
- Nov 12, 2026
- Public disclosure date
- Severity
- Sharted
- No CVE: a breach, not a bug
- Splash zone
- Some current and former TSMC employees whose information appeared on an external website.
- TSMC · employee data · cloud
- In the wild
- Yes
- TSMC confirms unauthorized publication of employee information.
What happened
TSMC says its investigation found no evidence that its own systems were compromised and says the information was unrelated to operations or customer data. The filing identifies where matching records were held. The provider and the route used to obtain the records remain unknown. It also gives no verified number of records or people. L3 reflects confirmed external exposure at a major employer with the scale still unknown.
Crime-scene timeline
Nov 12, 2026
TSMC discloses the exposure in a Form 6-K
The company is notifying affected people and working with the cloud provider, authorities and external security specialists.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- TSMC Form 6-K filed with the SECPrimaryConfirms the unauthorized posting, cloud record match and notification effort.