TSMC confirmed on Thursday that data belonging to some current and former employees was posted on an external website without authorization. The company said so in a statement filed with the SEC, and sellers on two underground forums are asking 3 Bitcoin for the records, worth about $220,000 at Thursday’s price of $73,444.
TSM stock closed Wednesday at $413.35, up 4.25%, after October revenue of NT$586.89 billion rose 59.7% year over year. TSM stock was quoted at $393.11 in Thursday’s premarket, down 4.90%, alongside a broad semiconductor selloff.
TSMC Told the SEC Its Own Systems Were Not Compromised
The filing, signed by chief financial officer Wendell Huang, says the company has “found no evidence that TSMC’s systems have been compromised.” It adds that the exposed information “has been verified to match data stored in the system services of a cloud service provider.”
TSMC says the leaked data is unrelated to its operations or its customers, and that it is notifying affected personnel. It is working with the cloud vendor, investigating authorities and a third-party cybersecurity firm. The company has not named the provider or said how the records left it. Form 6-K is the route that puts the disclosure in front of holders of TSM stock.
The Sample File Carries 499 Entries and 19 Fields
Sellers on DarkForums and BreachForums claim roughly 46,000 records totaling 6.9GB and have threatened to publish everything if nobody buys within a week, according to Business Next. The asking price converts to about NT$7.4 million by local media calculation, and Taiwan News carried the confirmation the same day.
A sample file named tsmc.txt holds 499 entries with 19 fields each. The fields cover name, date of birth, job title, nationality, national ID number, home address, mobile number, email, bank information and the phone number and address of an emergency contact. Those fields come from the sellers rather than from TSMC, which has confirmed the leak without specifying what it contained. If the sample is authentic, the exposure reaches relatives listed as emergency contacts who never worked at the company, which widens the affected population well past the headcount behind TSM stock.
Investor Takeaway
TSMC’s filing places the data inside a cloud vendor’s systems and outside its own, so the financial exposure behind TSM stock is a liability question about outsourced processing rather than a breach of the fabs or customer designs.
Three of Taiwan’s Five Recent Breaches Trace to Outside Vendors
Taiwan has logged five disclosed incidents in five weeks, and three of them point at an outside system. The 104 Job Bank said about 120,000 resumes were read without authorization on 6 October. 91APP reported exposure of order data for 1,329 brands and roughly 4.79 million consumers on 16 October, after an unpatched flaw in the third-party tool Appsmith.
E.Sun Bank disclosed 418 accounts drained of NT$41.76 million on 3 November through an external supplier’s new banking system, and ezTravel put more than 690,000 people at risk on 9 November. TSMC is the fifth, and the smallest by headcount apart from the bank, which is why the sequence matters more to TSM stock than the count does.
TSMC’s 46,000 records are a hundredth of what 91APP exposed, which makes the supplier vector the pattern behind the TSM stock story rather than the scale of the leak itself. Source: Business Next · Chart: FinanceFeedsThe same shape repeats outside Taiwan, and Coinbase denied a direct breach while confirming customer information was exposed through an analytics vendor on 3 November. DriveWealth blamed a social engineering campaign for a Revolut customer data breach, and Gnosis Pay disclosed its own customer breach on 7 November.
TSM Stock Fell 4.9% Premarket on the Nvidia Selloff
Thursday’s decline in TSM stock arrived with Nvidia down 6.03% premarket after the Wall Street Journal reported that its board is preparing to remove Jensen Huang. Micron, Arm and Marvell had all closed higher on Wednesday, and the whole complex reversed overnight, which puts the move on the Nvidia story rather than on the leak.
Wednesday’s 4.25% gain and Thursday’s 4.90% premarket fall roughly cancel each other, and the data leak was confirmed between the two sessions without being what moved TSM stock. Source: TradingViewTSM stock is up 32.49% this year and down 8.86% over a month, on TradingView data, with a market capitalization of $1.89 trillion and a trailing price to earnings ratio of 25.52. The January to October revenue total reached NT$4,485.62 billion, up 43.3%, which is the trajectory that took TSM stock to $430 after the Q3 print. Fourth-quarter results are due around 21 January, which gives the investigation two months to produce a named vendor before management next faces questions.
Taiwan’s Law Treats the Vendor as TSMC
Article 4 of Taiwan’s Personal Data Protection Act treats a contractor that collects, processes or uses personal data on a company’s behalf as the commissioning agency. Outsourcing the processing does not transfer the obligation, so whether TSMC carries liability depends on whether either party breached the act and whether damage followed. How the two split it depends on the investigation and their contract.
Article 29 puts the burden on a non-government body to prove it acted without intent or negligence. Where a victim cannot establish actual losses, courts may award NT$500 to NT$20,000 per person per incident, with a NT$200 million cap across a single event. TSMC has announced no compensation plan, and Article 34 allows qualifying public interest organizations to bring group actions, which is the route that would put a number on the TSM stock exposure.
Investor Takeaway
The NT$200 million statutory cap is roughly $6.4 million against a $1.89 trillion company, so the legal tail is immaterial to TSM stock and the question that matters is whether the same vendor holds process or customer data anywhere in the supply chain.