TSD Confirms Data Breach Affecting 200,000 Investors

Thailand Securities Depository (TSD) confirmed an unauthorized access incident affecting approximately 200,000 shareholders out of 5 million total users of its TSD Investor Portal. The incident was discovered on the evening of July 25, 2569, when staff detected abnormal behavior from a user who accessed the system through their own account but used a user profile editing method to extract data from other users in large quantities. TSD immediately closed the security vulnerability, suspended access to the affected system, and reported the incident to the Securities and Exchange Commission, data protection authorities, and cyber police for investigation.

The compromised personal data included names, dates of birth, ID numbers, addresses, phone numbers, email addresses, securities company names, trading account numbers, bank names, and deposit account numbers. However, TSD confirmed that securities holdings data, share quantities, portfolio values, and securities trading transaction information were not breached, and no financial losses have been detected to date. The company notified all affected users via email and SMS, coordinated with securities firms and banks to enhance transaction monitoring, and reported the incident to all relevant regulatory authorities.

TSD IT expert Tiraphan Sanpakij clarified that the incident occurred only in the TSD Investor Portal website system and did not affect the newly launched Wiset application, which uses different technology with higher security standards. The Investor Portal has been in service for over 5 years, while Wiset was developed with modern technology and TSD plans to gradually migrate services to the new platform. TSD's system architecture separates the front-end display system, back-end data storage system, and trading/matching systems, with the back-end not directly connected to the internet, preventing unauthorized access to securities holding information.