TSMC Says Employee Data Was Posted Online, With No Sign Its Own Systems Were Breached

TSMC has told U.S. securities regulators that personal data on some of its current and former employees was made available on an external website without authorization, and that it has so far found no evidence that its own systems were compromised. Taiwan Semiconductor Manufacturing Company Limited filed the statement with the Securities and Exchange Commission on Nov. 12, 2026.

The filing says the information has been verified to match data stored in the system services of a cloud service provider, and that it is "unrelated to the company's operations or customer-related data." The chipmaker adds that it has been informing the employees affected and providing them with support.

TSMC says it has engaged the cloud service vendor, the relevant investigating authorities and a third-party cybersecurity agency to establish the facts together and take the actions needed.

The statement leaves most of the scope open. It does not say how many current or former employees are affected, what the data contains, when the information was posted or when TSMC found it. It names neither the cloud service provider nor the website.

The document is a Form 6-K, the report that a company based outside the United States files to put information before U.S. investors, and it is signed by Wendell Huang, TSMC's senior vice president and chief financial officer.