TSD Data Breach Exposes 200,000 Thai Investors' Personal Info

Thailand's Securities Depository Company (TSD) confirmed a cybersecurity breach of its Investor Portal system detected on July 25, 2025, affecting around 200,000 of its 5 million account holders. The unauthorized access exposed personal data including names, dates of birth, national ID numbers, addresses, phone numbers, emails, brokerage firm names, trading account numbers, and bank account information, though securities holdings, trading records, and login credentials remained secure. TSD Manager Pichaya Chomchaiyya apologized and announced remediation measures.

Thailand Securities Exchange officials identified the root cause as an access control vulnerability in the User Profile system that allowed one user to modify another user's ID and access their data. The flaw was immediately closed following discovery, and authorities are investigating the perpetrator. The Stock Exchange of Thailand emphasized that the TSD Investor Portal is a separate information service system unconnected to settlement or trading systems, so no investor assets were affected.

The Exchange announced comprehensive cybersecurity upgrades including AI-powered anomaly detection, increased penetration testing, enhanced authentication systems, and migration to new platforms. Thai authorities warned the public that leaked personal data could be misused for identity fraud, unauthorized financial service applications, credit fraud, or phishing schemes, urging investors to monitor their accounts and verify contact sources. The Technology Crime Investigation Division is actively investigating to prosecute the perpetrator.