More Than Half of Thailand's Data Breaches Weren't Hacks: What the PDPC's 1,650 Cases Say About Your Old Devices

อ่านภาษาไทย

The Regulator's Numbers Tell a Different Story

When people in Thailand hear the words "data leak", most picture a hacker, a ransom note or a database for sale on the dark web. The country's data protection regulator says that picture is only half right.

At a media briefing on 21 October 2026, the Office of the Personal Data Protection Committee (PDPC) said it had received 1,650 personal data breach notifications between 2023 and 31 May 2026. Of those, 849 cases, or 51.45%, were classed as non-cyber incidents, while 747 cases, or 45.27%, were cyber incidents and 54 had other causes. Within the cyber group, 567 were cyber threats and 180 were linked to social media. The non-cyber group, the office said, mostly involved human error, as reported by MGR Online and Naewna.

PDPC Secretary-General Pol Col Surapong Plengkham put it plainly: the 1,650 figure shows that a data leak is not simply a question of whether an organisation was hacked, because more than half of the cases fall into the non-cyber and human-error group. Prevention, he said, has to cover the whole system, from technology and people to work processes and the data protection culture inside an organisation.

Who Reported the Most

The finance, investment and insurance sector filed the most notifications, with 723 cases. It was followed by government agencies and state enterprises with 206, retail, wholesale and e-commerce with 204, energy, utilities and manufacturing with 105, and healthcare with 87. Of the 1,650 incidents, 569 were still being handled, 1,071 were under monitoring and nine had been sent to the PDPC's expert committee, the body that can order administrative fines.

The same briefing also revealed 4,210 complaints and requests for advice, 3,889 of them about private-sector organisations. The most common issue was disclosure of personal data without consent, with 1,025 complaints.

What "Human Error" Usually Looks Like in an Office

The PDPC did not publish a detailed breakdown of the non-cyber cases beyond saying most involved human error. But anyone who has worked in a Thai office knows the everyday ways data slips out without a hacker ever being involved: a spreadsheet emailed to the wrong person, a shared folder left open to anyone with the link, a laptop that leaves with a departing employee and is never wiped, a phone handed in for repair with the company LINE groups still signed in, or a box of old hard drives that sits in a storeroom until someone sells it for scrap.

The last few examples are the ones that tend to be forgotten, because nothing visibly goes wrong on the day. A retired device does not raise an alarm. It simply keeps its data until someone, somewhere, plugs it in.

What This Means for Your Company

• Your firewall does not cover the storeroom. If more than half of reported breaches are non-cyber, then security spending that stops at the network leaves a large gap. Old laptops, desktops, phones and backup drives are part of your data footprint until their storage is wiped or destroyed.
• Every hand-off is a risk point. Staff resignations, office moves, hardware refreshes, repairs and lease returns are exactly the moments when devices change hands and steps get skipped. Deleting files or formatting a drive does not remove data; free recovery tools can bring it back.
• The PDPA expects a system, not good intentions. Data controllers must keep appropriate security measures and have a system for erasing or destroying personal data that is no longer needed. Our guide to PDPA data destruction requirements explains how this applies to retired hardware.
• Regulated sectors carry the heaviest load. Banks, insurers, brokers, hospitals and retailers hold the most sensitive customer data, and the regulator's figures show they are the ones notifying breaches most often. A documented disposal trail is one of the simplest ways to show you took the risk seriously.

A Simple Device Checklist to Cut Human Error

1. Keep a live register of every device that stores data, including laptops, desktops, phones, tablets, servers, NAS units and loose drives, and note who holds each one.
2. Make device return and data removal a fixed step in staff offboarding, signed off by IT, not left to the departing employee. Our laptop data destruction service covers machines coming back from leavers.
3. Never send a device out for repair, resale, donation or scrap with readable storage inside. Remove and handle the drive first, or have the whole device wiped and certified.
4. Clear the storeroom on a schedule. Old disks and backup drives can go for hard drive and SSD destruction, and retired company handsets for secure phone data destruction.
5. Keep the paperwork. A certificate for each device, showing its serial number, the method used and the date, is what lets you prove the data is gone.

Our IT asset disposal service is built to take the human error out of that last step. Every device with storage is securely erased first, with physical destruction available when a drive cannot be verified clean or your policy requires it, backed by photo and video evidence. Each device gets a Certificate of Data Destruction or Certified Erasure, and you receive a full inventory report. For bulk jobs, a technician can come to your Bangkok office to remove desktops, laptops, servers and networking equipment and record every item taken away. We handle electronic devices only; we do not shred paper.

Hackers will always make the headlines, but the regulator's own numbers show that ordinary mistakes cause just as many leaks. Get an instant quote or call 082-797-3702, and we will make sure the laptops, drives and phones your company no longer uses are wiped or destroyed for good, so a forgotten device never becomes your next breach notification.

Sources: MGR Online, "สคส. เคลียร์ใจสื่อ" PDPC media briefing report (21 Oct 2026); Naewna, PDPC reveals 4,210 complaints and 1,650 breach notifications (21 Oct 2026); Siam Rath, PDPC complaint and breach statistics (Oct 2026).