A top iPhone supplier, Taiwan Semiconductor Manufacturing Co. (TSMC), has recovered from a WannaCry ransomware infection that impacted the majority of its fabrication tools. The incident could delay mobile phone shipments during the pre-holiday Fall rush, and reduce revenue for Taiwan’s largest company.
TSMC said that a “computer virus outbreak” began spreading across its production lines Friday night – an outbreak that was caused by the WannaCry ransomware, the company confirmed today in a call with reporters.
The infection started due to “misoperation during the software installation process for a new tool,” TSMC explained in a notice posted Sunday. That opened the door to the malware spreading once the tool was connected to the company’s computer network. CEO CC Wei stressed to reporters on Monday that the incident was not a targeted attack, but rather lack of appropriate virus scanning.
“This is purely our negligence, so I don’t think there is any hacking behavior,” he said. “We regret this. There won’t be any more human errors.”
WannaCry made global headlines last May, when it infected more than 200,000 machines in 150 countries, causing billions of dollars in damages and grinding global business to a halt. The speed and scale of the attack – helped along by leaked National Security Agency hacking tools – was on a scale never previously seen.
The good news is that in this case, TSMC quickly got a handle on the problem and achieved full recovery today. “The degree of infection varied by fab,” it said. “TSMC contained the problem and found a solution … TSMC has taken actions to close this security gap and further strengthen security measures.”
It also said that data integrity and confidential information were not compromised.
However, production lines were halted for two days, and the effects to the global supply chain for mobile phones could be felt for the third quarter and beyond – which is when Apple, TSMC’s largest customer, traditionally debuts its new wares for the year. TSMC is the exclusive factory partner for a custom processor that goes into iOS devices; as such, Apple orders account for more than 21 percent of its revenue, according to data compiled by Bloomberg.
“TSMC expects this incident to cause shipment delays and additional costs,” the company said. It also estimated the impact to third-quarter revenue to be about 2 percent [it previously forecast $8.45 billion to $8.55 billion in revenue for the time period], and impact to gross margin to be about one percentage point.
The supply-chain hiccup will be ironed out sometime in the fourth quarter, TSMC said: “The company is confident shipments delayed in third quarter will be recovered in the fourth quarter 2018, and maintains its forecast of high single-digit revenue growth for 2018 in U.S. dollars given on July 19, 2018.”
However, Apple (which last week became the first-ever U.S. company to command a $1 trillion market capitalization, making its output larger than the GDP of most countries, including Taiwan) is eyeing Q3 as a critical period. Shareholders will be watching closely to see if the company can maintain its momentum – the fiscal Q3 results that spurred the $1 trillion valuation from the market were largely spurred by the success of the iPhone X.
This fall, it plans to debut three new iPhone models in time for the holiday season, according to reports, along with new iPad and Apple Watch models – all devices that have in the past used chips produced by TSMC.
“If the most advanced 7nm process products suffer a major impact, then concern could arise over a potential launch delay for next-gen iPhones,” SMBC Nikko analysts wrote in an investor note obtained by Bloomberg on Monday.
In addition to supplying the giant from Cupertino, TSMC manufactures chips for a range of hardware-makers, including Qualcomm for Android phones, but it hasn’t said which customers could be affected.
“Most of TSMC’s customers have been notified of this event, and the company is working closely with customers on their wafer delivery schedule,” TSMC said. “The details will be communicated with each customer individually over the next few days.”