The Taiwan Semiconductor Manufacturing Company (TSMC) has responded to claims by the ransomware group LockBit that they had hit TSMC by saying that one of its suppliers had been hit, not TSMC itself. Yesterday LockBit published on their website a claim that they had stolen information from TSMC with their ransomware, demanding 70 million dollars by their established deadline of August 6th, or else they would release the information.
TSMC has refuted this, however, stating that one of their suppliers has been hit while they remain untouched.
“At TSMC, every hardware component undergoes a series of extensive checks and adjustments, including security configurations, before being installed into TSMC’s system. Upon review, this incident has not affected TSMC’s business operations nor did it compromise any TSMC’s customer information. After the incident, TSMC has immediately terminated its data exchange with this concerned supplier in accordance with the Company’s security protocols and standard operating procedures. TSMC remains committed to enhancing the security awareness among its suppliers and making sure they comply with security standards. This cybersecurity incident is currently under investigation that involves a law enforcement agency”.
TSMC has said the supplier that was hit is named Kinmax, a systems integrator that is also based in Taiwan. On June 29th Kinmax stated its “internal specific testing environment” was breached and that “some information was leaked”, apologizing to their customers as “the leaked information contained their names which may have caused some inconvenience”.
According to TSMC’s statement law enforcement agencies are getting involved with the case.
