The Thailand Securities Depository Co., Ltd. (TSD) released a new statement on July 28, 2026, providing a critical update on the recent data security incident involving the TSD Investor Portal. Following a joint investigation with cyber police, the agency has identified additional categories of leaked personal information but maintains that core financial assets are secure.
According to the latest statement, TSD’s collaboration with the Cyber Crime Investigation Bureau (CCIB) on July 27 revealed that the breach was more extensive regarding personal details than initially reported. The leaked information now includes:
- Full names, dates of birth, National ID numbers, and addresses.
- Phone numbers and email addresses.
- Names of securities companies (brokers) and trading account numbers.
- Bank names and bank account numbers.
Despite this, TSD emphasizes that securities holdings (portfolios), transaction histories, and actual assets remain unaffected. This is because the backend system for managing securities is strictly separated from the front-end Investor Portal used by the public. The leaked data cannot be used to alter stock balances or execute unauthorized trades.
The breach was first detected on the evening of Saturday, July 25, 2026, when IT staff noticed abnormal attempts to access the system. By the morning of July 26, a deep investigation confirmed that unauthorized access to member profiles had occurred.
TSD immediately suspended the Investor Portal service and notified the Office of the Personal Data Protection Commission (PDPC) and the SEC. Initial estimates suggest that approximately 200,000 users were affected out of a total user base of 5 million.
Technical Cause and Remediation
The investigation identified a vulnerability in the code of the “Edit User Profile” screen. A user was able to log in normally and then manipulate their User ID to scrape the profile data of other users in bulk.
In response, TSD has implemented the following security measures:
- AI Code Scanning: Using Artificial Intelligence to scan all system code within the Stock Exchange of Thailand (SET) group to prevent similar vulnerabilities.
- System Migration: Moving services from the 5-year-old web-based portal to a more secure mobile application called “wiset,” which TSD confirms was not impacted by this event.
- Legal Action: Working with ThaiCERT and the CCIB to track the perpetrator’s IP address and logs.
- Compensation: TSD Chairman Asadej Kongsiri stated the company would consider appropriate remedies for those affected based on the facts of the damage.
Urgent Advice for Investors
TSD urges investors to be on high alert for “Spear Phishing”—scams where criminals use leaked details to appear credible.
- Verify Emails: Official emails from TSD will only come from [email protected] and will never contain links.
- Protect Credentials: Never share passwords or OTP codes with anyone claiming to be a TSD or broker official.
- Update Security: Change passwords for all online accounts regularly and avoid using the same password across multiple platforms.
Investors with concerns can contact the TSD Contact Center at 0-2009-9999 (available 24/7) or contact their respective brokerage firms directly.
