The Digital Economy Ministry says about 200 million login credentials tied to Thai systems have leaked, including 35,000 private-sector systems. Government agencies must force password resets and clean up old systems within 15 days. A proposed cabinet resolution could make multi-factor authentication (MFA) legally required for both government and private organisations, though the timeline is over a month and not yet set. Action now: change shared and admin passwords, turn on MFA for any system you use with government or hold customer data in, and review old systems you have forgotten to shut down.