AIMC Confirms Data Breach Affecting 170 Course Registrants
Thailand's Association of Investment Management Companies (AIMC) confirmed a data breach exposing personal information of 170 people who registered for its training courses. The leak, caused by browser-stored credentials and potential malware on users' devices rather than a direct system hack, included names, birthdates, ID numbers, and phone numbers. AIMC has notified affected users, added two-factor authentication, and reported the incident to the Personal Data Protection Commission and the SEC, stressing that no investor or fund management company data was compromised.
The Association of Investment Management Companies (AIMC) has acknowledged a personal data leak affecting 170 individuals, insisting it does not impact investors.
November 9, 2026 – The Association of Investment Management Companies (AIMC) clarified the user data leak after receiving notification from the National Cyber Security Agency on November 4, 2026. An investigation found 170 affected individuals. The leaked personal data includes names, birthdates, national ID numbers, and phone numbers.
The breach originated from the web browsers of individuals who registered for training courses or exams offered by the association. Users may have stored usernames and passwords in their browsers or installed software containing hidden malware, allowing hackers to access their data. The incident did not result from a direct attack or intrusion into AIMC's database.
Upon discovery, AIMC promptly implemented response measures, notifying all 170 affected individuals via email on November 6, 2026, and advising them to change usernames and passwords. The association also added OTP verification for website access, established a call center to assist users, and warned against installing potentially malicious software.
Simultaneously, AIMC reported the incident and remedial actions to the Personal Data Protection Commission and the Securities and Exchange Commission (SEC).
AIMC emphasized that the leaked data does not belong to securities firms managing mutual funds or to investment unit holders. A database system review found no direct intrusion into AIMC systems. The association maintains cybersecurity measures and regularly conducts security testing to close high-risk vulnerabilities, particularly for internet-connected systems and critical APIs.
