TSD breach exposes 200,000 investors to fraud and impersonation risks
Leaked TSD Investor Portal data includes ID, contact, brokerage and bank account details, but securities holdings and transactions remain unaffected
- A data breach at the Thailand Securities Depository (TSD) exposed the personal and financial information of approximately 200,000 investors via its Investor Portal.
- The compromised data includes full names, national ID numbers, addresses, brokerage account numbers, and bank account numbers.
- TSD confirmed that investors' securities holdings and transaction records were not affected by the breach.
- Authorities are warning affected investors of potential follow-up scams, such as spear phishing, where criminals use the stolen data to create credible-looking fraudulent messages.
The Thailand Securities Depository has confirmed that personal, brokerage and bank account information belonging to about 200,000 investors was exposed through unauthorised access to its Investor Portal.
TSD managing director Pichaya Chomchaiya acknowledged that the breach involved more sensitive information than initially assessed, including investors’ bank account details.
She stressed that securities holdings and transaction records remained secure and that the incident was confined to the web-based TSD Investor Portal, which has operated for more than five years.
The affected accounts represent about 200,000 of more than five million shareholder accounts held in TSD’s systems.
TSD and the Cyber Crime Investigation Bureau provided an update on the investigation and measures for affected users following the discovery of unauthorised access on July 26.
TSD said it would examine the facts and provide appropriate assistance if investors suffered demonstrable losses as a result of the incident.
Personal and financial details exposed
Further examination conducted with the Technology Crime Analysis and Inspection Division after TSD filed a police complaint on July 27 found that the exposed information was more extensive than first estimated.
The affected data included:
- Full names, dates of birth, national identification numbers, addresses, telephone numbers and email addresses
- Names of securities companies and securities trading account numbers
- Bank names and bank account numbers
TSD said no information concerning securities holdings or securities transactions had been found among the leaked data.
The company also confirmed that its newer WiSSET application was unaffected because it was designed as a separate system.
TSD strengthens system safeguards
Thiraphan Sappakit, an IT official responsible for TSD’s systems, said the company immediately corrected the affected code and used artificial intelligence to scan the system for additional risks.
“We used AI to scan all the system’s code before recommending corrections,” he said. “That work has been completed, together with measures to strengthen identity verification.”
TSD’s front-end and back-end systems are separated, while the back-end matching system used for securities trading is not connected to the public internet.
The company said this structure prevented the incident from spreading to investors’ portfolios and trading operations.
Police warn of follow-up scams
Pol Lt Col Phakrit Krittiyaphong, an inspector with the Cybersecurity Division of the Technology Crime Analysis and Inspection Division, said investigators were working with domestic and international partners, including ThaiCERT, to trace the digital trail.
He warned that criminals could use leaked information to make fraudulent messages appear credible, a technique known as spear phishing.
“Criminals may use this information by sending SMS messages or emails containing genuine details about the victim,” he said.
“They then exploit fear to pressure the victim into clicking a link. We call this a follow-up scam arising from the crisis.”
Investors should not immediately trust callers claiming to represent a brokerage or bank, even when they provide accurate personal or account-related information.
Police warned that criminals frequently exploit authority bias by posing as trusted officials to lower a victim’s suspicion.
TSD said it had sent email and SMS alerts directly to all 200,000 affected users.
It has also coordinated with brokers, custodians and commercial banks to monitor for unusual transactions.
Investors urged to verify messages
TSD and cybercrime police issued three recommendations for investors:
Check the source: Genuine SMS messages and emails from TSD will not contain links for recipients to click.
Inspect the URL: Messages containing links should be treated with caution, particularly when domains end in .xyz or use free domain services. Legitimate Thai institutional websites commonly use domains such as .co.th or .ac.th.
Act quickly when something appears wrong: Investors who notice unusual login activity or suspect that their information has been misused should immediately contact their financial institution and report the matter through the Anti-Online Scam Operation Centre hotline on 1441, which operates around the clock.
TSD also advised users not to disclose passwords or one-time passcodes to anyone and to change their passwords regularly.
Investors seeking further information may contact the TSD Contact Center on 0-2009-9999.
