TSMC discloses employee data exposure in Form 6-K filed November 12, 2026

TSMC disclosed the incident in a Form 6-K, a report foreign private issuers file with the U.S. Securities and Exchange Commission, on November 12, 2026. The filing, signed by Senior Vice President and Chief Financial Officer Wendell Huang, said some current and former employee personal data was made available on an external website without authorization. The company said it was informing affected personnel, providing support, and working with the cloud service vendor, investigating authorities, and a third-party cybersecurity agency.

The document's key qualifier is narrow: TSMC said it had found no evidence that its systems had been compromised. The filing, filed under Commission File Number 001-14700, also said the exposed information matched data stored in the system services of a cloud service provider and was unrelated to company operations or customer-related data. It does not name the cloud vendor, the website, the number of people affected, the data fields, or any attribution for the unauthorized access.

Because TSMC is the world's largest contract chipmaker and a critical supplier for advanced semiconductor manufacturing, any disclosure touching its information environment draws scrutiny beyond ordinary data breaches. Employee data can be valuable for phishing, identity fraud, or targeted social engineering, especially in organizations with high-value intellectual property and operational technology. The filing, however, places the incident on the cloud and personnel-data perimeter rather than in TSMC's production or customer systems.

The immediate impact is on current and former employees whose personal data may be exposed and who are receiving support. For customers, investors, and governments, the significance is the contrast between TSMC's strategic role and the disclosed scope: no documented compromise of operations or customer data, but an unattributed leak tied to a cloud provider shows how supply-chain risk can arrive through third-party data services. The company has not reported a production disruption.