TSMC allegedly hit by LockBit ransomware attack!

TSMC, the world's largest semiconductor manufacturer, has been listed on LockBit's dark web blog, with the gang demanding US$70 million for stolen data. The company confirmed that a "cybersecurity incident occurred at one of its IT hardware suppliers."

Recently, an entry for TSMC appeared on LockBit's blog. The company accounts for 65% of the world's semiconductors and 90% of high-end chip manufacturing.

The attackers did not specify what type of data they stole, but the cybercriminals are demanding a ransom of US$70 million, threatening to destroy or publish all data otherwise.

They threatened to publish network credentials, logins, and password details if TSMC refuses to pay. However, the post did not include any data samples, nor were there other indications of what type of information they might have.

TSMC was published on LockBit's leak site

▍TSMC "aware" of this cybersecurity incident

TSMC stated that the company is aware one of its IT hardware suppliers suffered a cyberattack, "resulting in the leak of information related to the initial setup and configuration of servers."

"Upon review, this incident did not affect TSMC's business operations, nor did it affect TSMC's customer data." Following the incident, TSMC immediately terminated data exchange with the supplier in accordance with the company's security protocols and standard operating procedures.

According to a statement shared by TSMC via email, the attackers breached Kinmax Technologies, a systems integrator specialising in networking, host/cloud computing, storage, security, and database management. The company was breached in the early hours of June 29.

"On the morning of June 29, 2023, the company discovered that our specific internal test environment was attacked, and some information was leaked. The leaked content mainly consisted of system installation preparation provided by the company to customers," Kinmax wrote in the statement.

The compromised company also issued an apology statement to its customers, saying the leaked data included customer names and "may have caused some inconvenience."

TSMC is known as one of the world's most critical companies because it holds the largest share of the global semiconductor market. The company has over 65,000 employees and its revenue in 2022 exceeded US$72 billion.

▍What is the LockBit ransomware gang?

The LockBit ransomware gang has been around since 2019, known for its eponymous malware. The gang has dominated the ransomware scene since early 2022, becoming the most prolific ransomware cartel on the market.

It primarily operates a Ransomware-as-a-Service (RaaS) model, paying a portion of the ransom profits to affiliates who execute the attacks. The notorious ransomware gang claims to have over 1,800 victims.

There is little doubt that LockBit's leader, nicknamed LockBitSupp, resides in Russia. The gang is also associated with other prominent Russia-aligned ransomware groups, such as Conti and its successor Black Basta, DarkSide and its descendants BlackMatter and BlackCat/ALPHV.

The most obvious example of the gang's notoriety is that it sometimes publishes details of more than 20 victim organisations in a single day, an amount other criminal gangs take a quarter to achieve.

Recently, Mikhail Matveev, residing in Kaliningrad and St. Petersburg, was indicted in absentia by the US on charges of using LockBit and other ransomware to launch cyberattacks against US law enforcement agencies and other critical targets.

Security verification has always highly valued LockBit ransomware and has repeatedly warned customer enterprises to guard against this gang. The Security Labs continuously update relevant attack techniques in our simulated attack library. Searching "LOCKBIT" in the platform provides access to relevant attack simulation experiments, thereby verifying whether the security defense system can effectively respond.