[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f2jfxsZlcan5U7YTC9LKywVVwDdhdLuLByko7etMaiHk":3},{"article":4,"iocs":38,"watch_terms":43,"solutions":44,"lesson":131},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"123cbd52-9874-4ed7-95ae-2b4b361816ce","TSMC confirms employee data breach tied to cloud service provider","tsmc-confirms-employee-data-breach-tied-to-cloud-service-provider-ccd63f","An investigation into the breach found that no TSMC systems were compromised but the information was “verified to match data stored in the system services of a cloud service provider, but is unrelated to the company’s operations or customer-related data.”","TSMC has confirmed a data breach affecting current and former employees, originating from a compromise of a third-party cloud service provider. The company stated that its own systems were not breached, and the stolen data is unrelated to its operations or customer information. A hacker offered the data, including contact, identification, and banking details, for 3 BTC on a cybercriminal forum.","TSMC confirms employee data breach via cloud service provider, impacting current and former employees.","https:\u002F\u002Ftherecord.media\u002Ftsmc-confirms-employee-data-breach-cloud-provider","http:\u002F\u002Fcms.therecord.media\u002Fuploads\u002FTSMC_logo_on_Taichung_factory_building_4ac5558127.jpg","2026-11-13T15:06:00+00:00","2026-11-13T16:00:18.950237+00:00",7,[17],{"name":18,"type":19},"TSMC","vendor","2e06f76c-d5b9-4f54-9eef-4d3447b10730",{"id":20,"icon":22,"name":23,"slug":24},null,"Breaches","breaches",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39],{"type":40,"value":41,"context":42},"malware","3 BTC","Ransom demand for stolen employee data",[18],{"controls":45,"vendors":130},[46,75,101],{"slug":47,"name":48,"problem":49,"products":50},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[51,59,67],{"vendor_slug":52,"vendor_name":53,"vendor_logo":54,"product_slug":55,"product_name":56,"url":57,"description":58},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":60,"vendor_name":61,"vendor_logo":62,"product_slug":63,"product_name":64,"url":65,"description":66},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",{"slug":76,"name":77,"problem":78,"products":79},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[80,88,93],{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":89,"product_name":90,"url":91,"description":92},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":102,"name":103,"problem":104,"products":105},"third-party-risk-management","Third-party risk management (TPRM)","You know which suppliers could hurt you, and you hear quickly when one of them is breached.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"upguard","UpGuard","\u002Fvendor-logos\u002Fupguard.png","upguard-vendor-risk","UpGuard Vendor Risk","https:\u002F\u002Fwww.upguard.com\u002Fproduct\u002Fvendor-risk","Supplier security questionnaires, ratings and continuous monitoring.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"onetrust","OneTrust","\u002Fvendor-logos\u002Fonetrust.png","third-party-management","OneTrust Third-Party Management","https:\u002F\u002Fwww.onetrust.com\u002Fsolutions\u002Fthird-party-management\u002F","Supplier inventory, risk assessments and monitoring across privacy and security.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"bitsight","Bitsight","\u002Fvendor-logos\u002Fbitsight.png","bitsight-tprm","Bitsight Third-Party Risk Management","https:\u002F\u002Fwww.bitsight.com\u002Fproducts\u002Fthird-party-risk-management","Supplier assessments and continuous monitoring based on security ratings.",[],{"slug":132,"title":133,"body":134,"framework_refs":135,"framework_notes":141},"third-party-cloud-provider-breach-exposes-tsmc-employee-data","Third-Party Cloud Provider Breach Exposes TSMC Employee Data","TSMC's employee data — including contact, identification, and banking details — was stolen not through a direct attack on TSMC, but via a compromise of a third-party cloud service provider. This highlights a critical and often underestimated risk: an organization's security posture is only as strong as its weakest vendor. Even though TSMC's own systems remained intact, sensitive personal data entrusted to a third party was exposed, demonstrating that data liability does not end at the corporate perimeter. Organizations must extend their security requirements and oversight to every vendor that handles their data, treating supplier security as an extension of their own.",[136,137,138,139,140],"NIS2 Article 21(2)(d)","ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships","ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII","GDPR Article 28","CIS Control 15: Service Provider Management (v8)",{"GDPR Article 28":142,"NIS2 Article 21(2)(d)":143,"CIS Control 15: Service Provider Management (v8)":144,"ISO\u002FIEC 27001:2022 A.5.34: Privacy and protection of PII":145,"ISO\u002FIEC 27001:2022 A.5.19: Information security in supplier relationships":146},"Article 28 requires that data controllers use only processors providing sufficient guarantees of appropriate technical and organisational measures, and mandates binding contracts governing how processors handle personal data — obligations TSMC held toward its employees whose data was stored with the vendor.","This point explicitly requires organizations to implement security measures covering supply chain security, including the security practices of third-party service providers — directly applicable since the breach originated with a cloud vendor.","CIS Control 15 requires organizations to establish a process to evaluate and manage service providers who handle sensitive data, including assessing their security practices — which could have surfaced the cloud provider's weaknesses before the breach occurred.","This control requires the organization to identify and meet requirements for the protection of personally identifiable information, which should have extended to ensuring the third-party cloud provider adequately protected employee PII.","This control requires organizations to define and implement processes to manage information security risks associated with suppliers, which would have mandated security vetting and obligations for the cloud provider that was compromised."]