TSMC disclosed that personal information belonging to some current and former employees was posted online without authorization. In a filing signed by CFO Wendell Huang, the chipmaker said the exposed information matches data held in the systems of a cloud service provider. TSMC reported no evidence that its own systems were breached and said the incident did not involve company operations or customer data. It is notifying affected employees and working with the provider, investigators and an external cybersecurity firm to determine what happened. The company has not named the provider, specified how many people were affected or described the data involved.
Separate reports cited by Wccftech, drawing on Taiwanese press coverage, say the leak may involve about 46,000 employee records, including home addresses, bank account numbers and emergency contacts. Those reports also say hackers demanded three bitcoin and threatened to publish the data if they were not paid, but TSMC has not confirmed these claims. The incident therefore raises a significant concern about the security of employee information held by a third-party service, while the extent of the exposure and the attackers’ demands remain unverified.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
Penlink’s Webloc, which uses advertising data for surveillance, has been purchased by security agencies across multiple countries. Citizen Lab warns the system enables intrusive mass surveillance, with particular risks in authoritarian states. (citizenlab.ca)
Nvidia chips reportedly reached China in large quantities after Commerce Secretary Howard Lutnick declined to enforce export controls and failed to replace them. Lutnick should resign, the author argues, over the resulting national security risks. (nytimes.com)
DOC-foundry uses AI agents to create Sigma security detection rules, then has a simulated attacker test them. A deterministic referee checks coverage before a stakeholder review chain approves the rule and records its review trail. (github.com)
The FBI warns that the FaceStealer scheme targets cryptocurrency holders and steals their funds. Treat unsolicited offers and links with caution, and verify crypto services before sharing information or sending money. (fbi.gov)
Cloudflare’s abuse-reporting page is reportedly blank, leaving visitors unable to use the form it directs them to. The page is intended for reporting abuse hosted through Cloudflare. (news.ycombinator.com)
Home Assistant stores refresh-token secrets and signing keys in plaintext, while some tokens never expire and survive password changes. Anyone who obtains the configuration directory or a backup can retain access to the home, and restoring a backup can revive old tokens. (seclists.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.