The SEC has been continuously monitoring the cyber threat situations occurring overseas, which may have a potential effect on critical systems and services. The SEC places a high priority on ensuring that business operators under its supervision are adequately prepared to respond to potential threats, maintain continuity of service, and mitigate the risks that may affect investors and the capital market.

Previously, on 3 November 2026, the SEC sent the circular letter to business operators under its supervision, including the SET and companies in the SET Group, to alert them to intensify their security measures against cyber threats. The SEC raised the importance to all business operators to strengthen their cybersecurity monitoring and safeguards, review the sufficiency of their current approaches, and enhance their preparedness to respond to any potential incident, commensurate with the level of risk. The letter also urged the boards of directors and senior executives of business operators to prioritize the management of information technology and cyber threat risks, emphasizing that such risk management is not solely the responsibility of the information technology function. The boards of directors and senior executives of each organization have full responsibility in this matter as well, including setting direction, allocating resources, monitoring the effectiveness of control measures, and ensuring that deficiencies are rectified in a timely manner.

In this regard, the SEC has already established supervisory measures for managing cyber threat incidents that may affect the business operators. The measures include processes for monitoring and assessing the severity of incidents, coordination among relevant agencies, and incident response procedures. The heightened efforts are put in place so that the SEC can ensure that appropriate and sufficient action can be carried out in accordance with the severity of the situation.

Mr. Anek Yooyuen, SEC Deputy Secretary-General and Spokesperson, said, “The SEC is closely monitoring the evolving cyber threat situation and continues to coordinate with business operators and relevant agencies. Most recently, the SEC has emphasized that business operators must strictly comply with cybersecurity rules and requirements to ensure timely responses, maintain system readiness to address cyber threats, and mitigate any risks that may affect investors and service delivery. Business operators are also required to report to the SEC on the actions taken to strengthen cybersecurity in response to the alert. In addition, the SEC will continue to monitor and assess risks as well as consider whether any further strengthening of measures is necessary in light of the situation.”