---
id: "CMP-202611-akt5u6"
page: "https://infrastack.ai/live/CMP-202611-akt5u6"
kind: "campaign"
aliases: []
title: "TSMC employee data breach: national ID numbers, addresses, contact and bank details of current and former employees stolen from a cloud provider and auctioned online; expect scams posing as TSMC"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "TSMC", "note": "employee data held at an unnamed cloud service provider", "fixed": [], "ecosystem": ""}]
ecosystems: []
tags: ["breach", "campaign", "early-warning"]
not_affected_if: []
published_at: null
first_seen_at: "2026-11-15T15:47:51+00:00"
updated_at: "2026-11-15T15:49:11+00:00"
sources: [{"source": "analyst", "url": null, "first_seen_at": "2026-11-15T15:47:51+00:00"}]
exploit_sources: []
---

# TSMC employee data breach: national ID numbers, addresses, contact and bank details of current and former employees stolen from a cloud provider and auctioned online; expect scams posing as TSMC

Link for people: https://infrastack.ai/live/CMP-202611-akt5u6 (this .md is for agents)

TSMC confirmed (SEC filing, reported by BleepingComputer 15 Nov 2026) that personal data of current and former employees was put on an external website without authorization. The leaked data matches data stored with a cloud service provider TSMC uses (provider not named); TSMC says it has found no evidence its own systems were compromised, and operations and customers are not affected. On 8 Nov 2026 the actor 'SmithBianl' posted a 499-row sample on a hacker forum, claiming a 6.9GB set of 46,000 employee records with national ID numbers, addresses, contact details and banking information, auctioned from 3 BTC with a threat to leak it for free from 15 Nov 2026. TSMC is notifying affected staff and has hired an outside security firm. Which cloud provider was breached, and whether other customers of that provider were hit, is unknown.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- :TSMC affected range not listed fixed no fixed version listed

## Cause

How the attacker got in: not disclosed yet (unknown). TSMC says it found no evidence its own systems were compromised, and the leaked data matches data stored with an unnamed cloud service provider, but the record does not say how the attacker got into that provider.

How it reached others: customers' data or keys went with it (third-party-breach).

Last month's incidents with the same cause, and the full checklist: https://infrastack.ai/live/breaches.md#third-party-breach

## How to check

You are exposed if you are a current or former TSMC employee. Watch for messages claiming to be TSMC, HR, payroll or a bank that quote your national ID, address or bank account, and for the TSMC dataset (alias SmithBianl, 6.9GB / 46,000 records) on leak forums. The cloud provider's name and any sender or link domains are unknown.

## Fix

If you are a current or former TSMC employee: watch your bank accounts, be wary of calls, texts and emails that use your personal details, confirm any TSMC or bank request through a known channel, and consider a credit or ID fraud alert where available. Companies using TSMC's unnamed cloud provider should wait for the provider to be named and check its notices.

## Timeline

- 2026-11-15T15:47:51+00:00 analyst

## Documents

- [describes] @BleepinComputer: TSMC employee data breach linked to cloud provider
https://t.co/7sRYVR86zH

http https://x.com/BleepinComputer/status/2121987646058557668
- [describes] BleepingComputer: TSMC employee data breach linked to cloud provider https://www.bleepingcomputer.com/news/security/tsmc-employee-data-breach-linked-to-cloud-provider/

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_