Thailand's PDPC is investigating widespread credential leaks from government agencies — framed as more critical than hacking because leaked passwords grant unfettered system access. Experts identify systemic weaknesses: inconsistent password standards across state bodies, poor outsourcing oversight, missing Data Processing Agreements, and software contracts that don't mandate PDPA compliance. The 30-day probe will determine administrative and criminal liability; government agencies are now expected to adopt stricter cyber controls than private sector peers.