Data leak hits 170 users of investment association website

Business General Data leak hits 170 users of investment association website PUBLISHED : 10 Nov 2026 at 05:46 NEWSPAPER SECTION: Business WRITER: Nuntawun Polkuamdee Listen Small Medium Large Share Facebook Reddit Copy Link The Association of Investment Management Companies (AIMC) has confirmed a personal data leak affecting 170 users of its website, although an investigation found no direct breach of its database. The incident highlights growing cybersecurity risks as businesses expand their digital services. In a statement issued on Monday, AIMC said it was notified by the National Cyber Security Agency (NCSA) on Nov 4 that user information had been leaked. The incident involved information stored in users' web browsers when they registered for training courses or sat examinations through the association's website. The investigation found that some users may have saved their usernames and passwords in their browsers or installed software containing malware, potentially exposing their information to hackers. The leaked information included partially exposed personal details, such as full names, dates of birth, national identification numbers and telephone numbers. AIMC said it had found no evidence of hackers directly accessing its database. It notified all 170 affected users by email on Nov 6, advising them to change their usernames and passwords. The association has also introduced one-time password (OTP) verification for website access, established a call centre and urged users to exercise caution when installing software. AIMC said it had reported the incident and its response measures to the Office of the Personal Data Protection Committee and the Securities and Exchange Commission. It stressed that the leaked information did not involve data held by asset management companies or personal information belonging to mutual fund unitholders. The association added that it regularly reviews its cybersecurity systems and conducts vulnerability assessments, particularly on internet-facing systems and critical application programming interfaces. Commenting on the incident, Arapat Sangkharat, chief executive of Maybank Securities (Thailand), said cybersecurity had become a top priority for businesses, as a single cyber-attack could damage corporate reputations and threaten business continuity. The growing use of digital applications and services has increased organisations' exposure to cyberthreats, while no system can guarantee complete protection, he said. "Risks can arise not only from software vulnerabilities but also from outdated computers and notebooks, as well as removable storage devices such as flash drives and external drives," Mr Arapat said. Organisations therefore need strict access controls and system segmentation to limit the spread of potential breaches and minimise damage, he added. KEYWORDS Aimc Data leak Cybersecurity Ncsa Personal data protection Thailand investment Information security COMMENT (1)