Taiwan Semiconductor Manufacturing Company Limited filed a Form 6-K on November 12, 2026, disclosing that current and former employee personal data was made available on an external website without authorization.

Key Highlights

  • Unauthorized exposure: TSMC disclosed that some current and former employee data was made available on an external website without authorization.
  • No systems compromise found: According to the filing, "we have found no evidence that TSMC's systems have been compromised."
  • Cloud service provider link: The data "has been verified to match data stored in the system services of a cloud service provider," the filing stated.
  • Operations and customers unaffected: TSMC stated the exposed information is "unrelated to the company's operations or customer-related data."
  • Impacted personnel notified: The company reported it has been informing affected individuals and providing them with necessary support.
  • Multi-party response engaged: TSMC disclosed it has engaged the cloud service vendor, relevant investigating authorities, and a third-party cybersecurity agency to investigate and take necessary actions.

TSMC Discloses Unauthorized Access of Employee Personal Data via Cloud Service Provider

Taiwan Semiconductor Manufacturing Company Limited (NYSE:TSM), filing under Commission File Number 001-14700, issued a statement on November 12, 2026, confirming that personal data belonging to current and former employees had appeared on an external website without the company's authorization. The filing, submitted as a Form 6-K for the month of November 2026, was signed by Wendell Huang, Senior Vice President and Chief Financial Officer.

According to the filing, TSMC determined that the exposed data matched information held within the systems of a cloud service provider. The company was explicit that the data is "unrelated to the company's operations or customer-related data," and that no evidence of a breach of TSMC's own internal systems has been found. The company did not identify the cloud service provider by name in the disclosure.

The filing stated that TSMC has begun notifying impacted personnel and is providing them with what it described as "necessary support." The company also disclosed that it has engaged three separate parties in its response: the cloud service vendor, relevant investigating authorities, and a third-party cybersecurity agency, all of which are working jointly to "ascertain the facts and take necessary actions." The filing closed with a commitment to "protecting employee privacy and safeguarding data security."

What Was Disclosed

TSMC disclosed in a November 12, 2026 Form 6-K that unauthorized access resulted in current and former employee personal data appearing on an external website, traced to a cloud service provider's systems, with no evidence of compromise to TSMC's own systems.