Expert says TSD data leak came from user-side malware, urges investors to act as human firewall

Regulation
โดย Kaohoon·Read original
Summary · why it matters

Professor Prinya Hom-anek, Executive Chairman of ACIS Information Security and a qualified member of the National Cyber Security Committee, revealed that the data leaked from the Thailand Securities Depository system was not investors' portfolio holdings, but general ID card information and which broker they use. This dataset has been circulating online for a long time. The root cause was malware planted on a high-level user's home computer to steal passwords, allowing criminals to use a single user account to extract over 200,000 records. Professor Prinya proposed that organizations shift from a blame culture to collective learning, adopt the NIST Cybersecurity Framework, and enforce two-factor authentication or passkeys, while moving from web browsers to native apps. Investors must serve as a human firewall by staying alert, applying the pause and verify principle, not saving passwords in browsers, and always keeping security systems updated.

Impact on stocks 0

Theme Impact 2

Off-coverage companies 2

Thailand Securities Depository Co., Ltd.Private▼ Negative
Regulationrelevance

Data leak from TSD system due to malware, raising security concerns and potential regulatory scrutiny.

ACIS Professional Center Co., Ltd.Private▲ Positive
Demandrelevance

Expert commentary highlights need for cybersecurity measures, potentially boosting demand for ACIS services.

Related news

Japan's National Police Agency says North Korean IT worker applied for engineer job at bitFlyer

Japan's National Police Agency announced on September 18 that a person believed to be a North Korean IT worker applied in May 2025 for an engineer position at the domestic cryptocurrency exchange bitFlyer. The applicant attached a résumé to the recruitment form under someone else's identity and applied directly rather than through an intermediary, but the company noticed suspicious behavior and responded, so no hiring or damage resulted. According to the National Police Agency, the applicant accessed the recruitment form using multiple VPN services, listed a Gmail address as contact information, and stated in the résumé a broad range of skills in programming languages, blockchain, and cloud services, along with graduation from a European university and work experience in cities in Europe and Asia. In an online interview, the applicant said they were from Malaysia and living in Finland, but refused to relocate to Japan or work on-site, or said they would agree only if it were six months out, insisted on being paid in cryptocurrency, frequently checked another monitor during the interview, and at times another person's voice could be heard from behind. The National Police Agency and the U.S. Federal Bureau of Investigation believe that the cyberattack group WaterPlum's activities and some of the foreign-currency earning operations by North Korean IT workers are centrally linked to the Workers' Party of Korea's Bureau 313, and the IP addresses used by the group's attackers, the North Korean IT workers, and the applicant to bitFlyer matched.
NADA NEWS·19hRead more →
5

GPF Joins Forces with 3 Partners to Strengthen Online Fraud Protection for 1.2 Million Members

The Government Pension Fund, or GPF, has signed a memorandum of understanding with the Deposit Protection Agency, Gogolook (Thailand) Company Limited, known as Whoscall, and National ITMX Company Limited, known as NITMX, to strengthen awareness of fraud and digital crime among GPF members and the general public. Mr. Sornphon Tulyasathien, Secretary-General of the GPF Board, said the organisation manages retirement savings for more than 1.2 million members, and that this collaboration is part of the Retirement Academy project. Under the partnership, Whoscall is providing 1.5 million Whoscall Premium Basic licences to GPF members and will jointly develop an e-learning course with its partners. Mr. Sornphon noted that in 2026, about 16,000 GPF members will retire, with average savings of 1.5 million baht per person. Mrs. Piyaporn Phoklin, Deputy Director and Acting Director of the Deposit Protection Agency, disclosed that from mid-2024 to the present, there have been 270 complaints from people deceived by scammers posing as the agency, with elderly victims accounting for 30 to 40 percent, and 24 victims who actually lost money, with losses ranging from a few hundred baht up to 400,000 baht. Mr. Manwoo Joo, Chief Executive Officer of Gogolook (Thailand) Company Limited, said a single scam phone number can make more than 800,000 calls. Mr. Chatchai Dusadeenod, Managing Director of National ITMX Company Limited, said this collaboration will help broaden the fight against digital crime and reduce the number of victims.
InfoQuest·1dRead more →

Microsoft Opens Government AI Suite October 1 With Features Still Pending Accreditation

Microsoft has told federal buyers that a new top government tier of its productivity suite, plus a companion agent-management product, will be available for Government Community Cloud customers to purchase on October 1, with individual capabilities lighting up in phases as each workload clears its required government security accreditation. The new suite layers Copilot, identity and security tooling, and agent-governance controls on top of the prior government tier, with the headline addition being Agent 365, which Microsoft has framed on the commercial side as providing security operations, financial operations, and observability and manageability of token spending across business processes. Microsoft has not disclosed per-seat pricing for the new tier or paid conversion rates from earlier no-cost federal Copilot deployments, leaving any government revenue forecast impossible, and the stock closed at $497.12, down 2.74% over the past year. On the commercial side, net paid seats more than doubled sequentially to over 30 million Copilot seats, while full-year capital expenditures hit $115.95 billion and free cash flow fell 23.19% in the quarter. Analysts carry an average price target of $572.92 with 38 Buy and 14 Strong Buy ratings, and the variable that decides the bull and bear cases is what Microsoft discloses in coming quarters about paid government seat counts and workload authorization progress rather than the October launch itself.
24/7 Wall St·2dRead more →