The DES Ministry will ask cabinet to back multi-factor authentication and password resets for government agencies after leaks exposed data from at least 20 state agencies. Leaked credentials bought on dark-web markets, not direct hacks, were the cause. For a Thai SME, the practical step is to turn on MFA for email, banking, cloud and e-tax accounts and change reused passwords. The article also stresses strict PDPA compliance, with legal penalties for organisations that fail to apply required security measures, so review what customer personal data you hold and how long you keep it.