Hackers have publicly offered what appears to be TSMC employee personal data for sale on an underground forum, claiming to possess as many as 46,000 records totaling 6.9GB and asking for 3 bitcoins, equivalent to about NT$7.4 million (1 New Taiwan dollar is about 0.20 yuan — editor's note), and even threatening to fully release the data if no one buys it within a week.
In response, Taiwan Semiconductor Manufacturing (NYSE: TSM) confirmed on the 12th that information of some current and former employees had been disclosed without authorization, but stressed that there is currently no evidence that TSMC's internal systems were breached, and that the data is unrelated to the company's production and customer information.
TSMC said it discovered that information of some current and former employees had been placed on an external website without authorization. After a preliminary review, the information was found to be consistent with data in the system of a certain cloud service provider, and there is currently no evidence that TSMC's own information systems were intruded upon.
According to information circulating online, hackers were selling what appeared to be TSMC employee data on an underground forum and publicly released a sample file named "tsmc.txt," said to contain 499 records, each involving 19 fields.
It is worth noting that TSMC's response this time revealed an important clue, namely that the data may be related to an external cloud service provider, rather than TSMC's core information systems being directly hacked. This has also shifted the focus of the incident from in-house information security protection at the wafer fab to the data management and information security responsibilities of third-party suppliers.
For TSMC, the world's most advanced semiconductor processes, customer chip design information and advanced packaging technologies are all core assets that must be strictly protected. The company emphasized that the disclosed data is unrelated to production and customer information, aiming to clarify the nature of the incident and prevent the market from conflating the leak of employee personal data with the outflow of core process technologies and trade secrets.
In particular, TSMC's supply chain spans the globe and involves numerous external information service providers. How to ensure that third-party operators possess information security management capabilities comparable to TSMC's will become a key focus of follow-up investigations and improvements.
Comments