Thailand's National Cybersecurity Committee (สกมช.) has ordered 20 government ministries to remediate 24,000+ legacy systems dating from 2011 onwards that lack modern security standards. The directive mandates adoption of multi-factor authentication (MFA) instead of single-factor passwords, while discouraging reliance on ThaiD alone due to scalability constraints. The committee found evidence of credential compromise (leaked passwords) but no large-scale data breaches yet. This addresses systemic cyber hygiene gaps in state IT infrastructure built before the 2019 Cybersecurity Act.