The Record reported that TSMC, one of the world's largest chip makers, told the US Securities and Exchange Commission on Thursday that a cloud service provider was breached. Criminals stole data on current and former employees. TSMC said its investigation found none of its own systems were compromised. Chief financial officer Wendell Huang said TSMC is telling affected staff and supporting them.
The provider is not named, and how it was breached is not known. Neither TSMC nor The Record says how many people are affected. A hacker posted an offer of 6.9 GB of employee data for about $200,000 on November 8; TSMC has not said whether this is the same data. The post allegedly covers contact, identity and banking details. TSMC did not answer questions about it.
By TSMC's account, the breach reached staff data without touching its own network. A company's exposure includes data it has handed to vendors, because that data sits in the vendor's service, outside the company's own security controls. Buyers can ask which staff data each vendor holds, what the contract sets as breach-notice deadlines, and who learns of a breach first.