By 
Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed that personal information belonging to current and former employees was accessed through a breach involving one of its third-party cloud service providers. The disclosure, made in a statement filed with the US Securities and Exchange Commission on November 12, follows reports that stolen employee records had been offered for sale on a cybercrime forum.
TSMC said its investigation found no evidence that the incident involved a compromise of its own internal systems. The company also stated that the exposed information was unrelated to customer data or its semiconductor manufacturing operations.
Third-Party Provider Identified as the Source
According to TSMC, the information was verified as matching records stored in the systems of a cloud service provider. The company has not publicly identified the provider.
The incident reportedly involves information associated with approximately 46,000 current and former employees. Data samples described in reporting about the breach included personal contact details, identification information, banking details and emergency contacts.
The company said it was notifying affected personnel and providing assistance. It has also engaged with the service provider, relevant investigating authorities and an external cybersecurity organisation to establish the full circumstances of the incident.
Employee Information Creates Additional Security Risks
Although TSMC said its manufacturing systems and customer-related information were not affected, employee records can still be valuable to cybercriminals. Personal details can be used to create convincing phishing messages, impersonate employees or target individuals through social engineering.
Information about employees at a major semiconductor manufacturer may also attract attackers seeking to exploit professional relationships or obtain access to corporate accounts.
The incident illustrates why organisations must assess the security of external technology providers that store or process employee information. A company can maintain strong internal controls while still facing exposure through systems operated by third parties.
Supply-Chain Security Under Greater Scrutiny
TSMC is one of the world’s largest semiconductor manufacturers, supplying chips used in smartphones, computers, data centres and other technology products. Its operations and customer relationships make information security an important concern for the wider electronics industry.
The company has said it is working with the relevant parties to investigate the incident and take appropriate action. The full extent of the exposed information and the identity of the service provider have not been publicly established in the cited disclosure.
The breach reinforces the need for stronger third-party risk management, restricted access to employee records and regular security assessments across cloud service relationships
Comments