TSD portal breach tests trust in Thailand’s capital market

Unauthorised access to the Investor Portal operated by Thailand Securities Depository (TSD) has placed the “back office” of Thailand’s capital market under scrutiny, testing its cybersecurity safeguards, protection of personal data and investor confidence.

TSD detected unauthorised access to users’ personal information in its Investor Portal on Sunday, July 26. The incident resulted in the exposure of some personal data.

TSD blocked access to the affected system, stopped the leak and strengthened its cybersecurity monitoring and preventive measures.

It also reported the incident to the relevant regulators and began notifying people whose data might have been affected, in accordance with legal procedures.

However, several important questions remain unanswered. TSD has not disclosed what categories of information were exposed, how many people were affected, when the breach began, how long it continued or whether the vulnerability involved the system itself, an internal actor or an external party.

What is TSD and why does it matter?

TSD serves as Thailand’s central securities depository and securities registrar. It handles securities in scripless form, covering instruments listed on the Stock Exchange of Thailand (SET) and the Market for Alternative Investment (mai), as well as certain unlisted securities, such as corporate and government bonds.

TSD began operations on 1 January 1995. It is an important part of the market’s post-trade infrastructure and can be viewed as both the central vault and the master register behind investors’ portfolios.

When an investor buys shares through a securities company, the visible part of the transaction takes place on the broker’s trading platform. Behind that screen, however, the securities must be deposited, ownership records updated, transfers processed and shareholder entitlements allocated.

TSD provides two main types of service.

The first is its securities depository service. TSD holds equity and debt securities in a scripless system, replacing traditional paper share certificates and other physical instruments.

Its services cover the deposit, withdrawal and transfer of securities, as well as pledges and the release of pledged securities. Investors complete these transactions through authorised securities depository participants.

The electronic system reduces the risk of certificates being lost, damaged or forged, while allowing securities transfers following trades to be processed more efficiently.

The second is its securities registrar service. TSD maintains registers of holders of securities listed on the SET and mai, as well as certain unlisted instruments, including corporate and government bonds.

This work includes maintaining securities-holder information, paying dividends and interest, distributing shareholder benefits, issuing tax documents and monitoring foreign ownership levels to ensure compliance with applicable limits.

In simple terms, TSD is not a brokerage that receives orders to buy or sell shares. It is the central mechanism that records who owns which securities, how many they hold and what benefits they should receive after a transaction has taken place.

 

What is the TSD Investor Portal?

TSD e-Service, also known as the Investor Portal, is an online platform through which securities holders can examine and manage information relating to their holdings and shareholder entitlements. The service is available around the clock.

Information and documents available through the portal include securities-holder records, securities balances, certificate information, securities held in issuer accounts, shareholder benefits, subscription results, issued and returned documents, withholding-tax certificates and certificates confirming securities ownership.

The Investor Portal is therefore different from a brokerage trading account. Investors do not use it to place orders to buy or sell shares directly. Instead, it allows them to manage information and transactions connected with their status as securities holders.

Nine main services are linked to TSD:

• TSD e-Service, or the Investor Portal, for checking securities-holder information online
• e-Document, for receiving securities-related documents electronically
• e-Proxy Voting, for appointing proxies for shareholder meetings electronically
• Securities registrar services, including the preparation and maintenance of securities registers
• e-Dividend, for receiving dividends, interest and other cash benefits through a bank account
• Securities transfer services, for transferring securities to another person
• Information amendment services, for correcting or changing securities-holder information
• Depository services, covering both equity and debt securities
• Information and document services, for examining records and requesting documents relating to securities holdings

Were investors’ money and shares affected?

According to TSD’s disclosure, the incident did not affect securities trading, financial information or assets held under its custody.

Based on the information currently available, there is no indication that investors’ shares or other assets were withdrawn, transferred or registered under different ownership because of the incident.

The disclosure also does not suggest that the securities trading system was breached or that trading was disrupted.

However, the fact that assets were unaffected does not mean the incident carries no risk. Information relating to a person’s identity, securities holdings, documents or shareholder entitlements could potentially be used to create targeted scams.

For example, if fraudsters know that someone is an investor, which securities that person holds or which entitlement they are waiting to receive, a fraudulent message could appear far more convincing than an ordinary mass-market phishing attempt.

What should investors do?

Users of the TSD Investor Portal, particularly those who have been notified that their information might have been affected, should change their passwords promptly.

They should not use the same password for the Investor Portal, email accounts, mobile banking applications, brokerage accounts or other online services.

Investors should also be cautious about messages or calls claiming that they must urgently “verify shareholder information”, “receive a dividend”, “correct an account” or “prevent shares from being transferred”.

Any request to click a link, download an application or disclose a one-time password should be treated with suspicion.

Anyone with questions about the Investor Portal can contact the TSD Contact Centre directly on 0-2009-9999. Questions relating to a brokerage account, trading activity or movements within a portfolio should be checked with the securities company through which the account was opened.

Why the incident matters beyond the technical breach

The episode is not merely a test of whether TSD can identify and close a technical vulnerability.

It also tests how the organisation’s board and management oversee cybersecurity risks, how transparently they communicate with the public and how they support people whose information may have been compromised.

In a capital market where enormous amounts of value depend on digital records, confidence may take decades to build. A single data leak, however, can force the entire system to demonstrate that such confidence remains justified.

Source: Thansettakij