[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fO_cZcxLP-XBiLfIK1ZPV8Va6Vo1XwpDk5OSbJbwQhcg":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":134},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"8ea220c7-b89d-49f3-b523-b5442c3bb46f","TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider","tsmc-data-breach-employee-data-exposed-via-third-party-cloud-provider-e36f61","Taiwan Semiconductor Manufacturing Company (TSMC) has confirmed that personal data belonging to some current and former employees appeared online without permission. The chipmaker disclosed the incident on November 12, 2026, saying the exposed information matched records stored by an outside cloud service provider. It found no evidence that its own systems had been compromised. The […] The post TSMC Data Breach – Employee Data Exposed via Third-Party Cloud Provider appeared first on Cyber Security News.","TSMC has confirmed that personal data of some current and former employees was exposed online. The chipmaker stated that the exposed information matched records stored by an outside cloud service provider, and that its own systems were not compromised. Reports suggest that 46,000 employee records, including names, national identification numbers, and bank account information, were offered for sale on dark web forums.","TSMC confirms employee data exposed online via third-party cloud provider.","https:\u002F\u002Fcybersecuritynews.com\u002Ftsmc-data-breach\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FTSMC-Data-Breach-Employee-Data-Exposed-via-Third-Party-Cloud-Provider.webp","2026-11-13T05:25:43+00:00","2026-11-13T06:00:37.092236+00:00",7,[17],{"name":18,"type":19},"TSMC","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",[39],{"type":40,"value":41,"context":42},"malware","Bitcoins","Reportedly offered for sale for three Bitcoins on DarkForums and BreachForums.",[18],{"controls":45,"vendors":133},[46,75,104],{"slug":47,"name":48,"problem":49,"products":50},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":76,"name":77,"problem":78,"products":79},"cloud-security-posture","Cloud security posture management (CSPM and CNAPP)","Misconfigured cloud storage and over-permissive roles get caught before they leak.",[80,88,96],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"orca-security","Orca Security","\u002Fvendor-logos\u002Forca-security.png","orca-cloud-security-platform","Orca Cloud Security Platform","https:\u002F\u002Forca.security\u002Fplatform\u002F","Agentless cloud security platform for posture, vulnerabilities and data exposure.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png","wiz-cloud","Wiz Cloud","https:\u002F\u002Fwww.wiz.io\u002Fplatform\u002Fwiz-cloud","Agentless cloud security posture and attack path analysis across major cloud providers.",{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-cloud","Microsoft Defender for Cloud","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fcloud-security\u002Fmicrosoft-defender-cloud","Cloud posture management and workload protection for Azure, AWS and Google Cloud.",{"slug":105,"name":106,"problem":107,"products":108},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[109,117,125],{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":135,"title":136,"body":137,"framework_refs":138,"framework_notes":144},"third-party-cloud-provider-exposes-46000-tsmc-employee-records","Third-Party Cloud Provider Exposes 46,000 TSMC Employee Records","TSMC's internal systems were not breached, yet sensitive employee data — including national ID numbers and bank account details — was exposed because a third-party cloud provider failed to adequately secure the data entrusted to it. This incident illustrates that an organization's security posture is only as strong as its weakest vendor link. Personal and financial data stored with external providers carries the same regulatory and reputational risk as data held internally. Organizations cannot outsource their data protection obligations along with the data itself.",[139,140,141,142,143],"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","NIST SP 800-53 SA-9: External System Services","NIS2 Article 21(2)(d)","GDPR Article 28",{"GDPR Article 28":145,"NIS2 Article 21(2)(d)":146,"NIST SP 800-53 SA-9: External System Services":147,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":148,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":149},"GDPR Article 28 requires that personal data processing by a third party (processor) be governed by a binding contract specifying security obligations, and the exposed employee PII suggests those contractual data protection safeguards were either absent or unenforced.","NIS2 explicitly requires security measures covering supply chain risks including the security of relationships between entities and their direct suppliers, directly applicable to the third-party cloud provider arrangement that caused this exposure.","SA-9 requires organizations to define and document security requirements for external system services and ensure providers comply, which would have established enforceable security obligations on the cloud provider holding employee records.","This control requires the organization to identify and meet requirements for the preservation of privacy and protection of personally identifiable information, covering data such as national ID numbers and bank details stored with third parties.","This control requires organizations to define and implement processes for managing information security risks associated with suppliers, which would have mandated security requirements on the cloud provider before the data was handed over."]