Fastwork Breach Exposed Thai ID Numbers: What Freelancers and Families Should Do Now

อ่านภาษาไทย

A Thai Freelance Platform Says User ID Numbers Were Copied

ChangeC Co., Ltd., the company behind the Thai freelance marketplace Fastwork, has notified users of a personal data breach after a cyberattack on 13 October 2026. According to the company's notice, as reported by Postjung on 23 October, an outside attacker using several foreign IP addresses began sending attack commands to its database and pulling data out from 00:37 that night. Engineers spotted the problem at 08:32, shut the system down at 09:38, fixed the vulnerability by 13:13 and brought the website and app back at 14:58.

As of 22 October, Fastwork said the data that may have been taken from some users' accounts is:

• 13-digit national ID numbers
• first names and surnames
• phone numbers
• email addresses

The company said it found no direct access to users' ID card image files, and had seen no ransom demand and no publication of the data. It reported the breach to the Personal Data Protection Committee office (PDPC) on 15 October, has hired outside security experts for an independent forensic review, and has closed the vulnerable function. It also warned that the stolen details could be used to impersonate users when applying for services, opening accounts, taking out loans or registering mobile numbers, and to make scam calls, texts and emails look convincing.

What This Means for You

A name, phone number and ID number together are exactly what a Thai scam caller wants. With them, a fake "bank officer", "police officer" or "Fastwork staff member" can read your own details back to you and sound completely official. The next step is almost always the same: send a photo of your ID card, take a selfie holding it, install an app, or click a link to "verify" yourself.

• Do not send ID photos or selfies to anyone who calls you. Fastwork says it will never ask for your password, OTP or PIN, and will only contact users from [email protected] and by SMS showing the sender name Fastwork.
• Check what is registered in your name. The company suggests checking your credit report with the National Credit Bureau, checking which mobile numbers are registered to your ID, and calling your network straight away if your SIM suddenly stops working.
• Turn on two-step verification for your email, since your email address is on the list too.
• Report misuse. Keep evidence, file a police report, and contact the company's DPO if you suffer a loss.

The Copies of Your ID You Still Control

You cannot pull your ID number back from a hacker. What you can control is the much richer material that turns an ID number into a working identity: the photos of your ID card, the selfie-with-ID you took to verify an account, the house registration scan you sent over LINE, and the contracts and receipts that carry your ID number. For freelancers this pile is usually bigger than most people's, because jobs come with signed contracts, invoices and withholding tax certificates, many of them sitting on an old laptop or in a phone's camera roll.

When that old phone gets sold, handed to a relative or left with a repair shop, all of those files go with it unless the device is wiped properly. A quick reset does not always remove them, as we explain in why a factory reset is not enough.

1. Search your phone gallery, downloads and LINE chats for ID card photos and selfies-with-ID, and delete the ones you no longer need.
2. Keep the documents you must keep in one protected place, rather than scattered across old devices.
3. Before any old phone, tablet or laptop leaves your home, back up what matters, sign out of LINE and banking apps, remove it from your Apple or Google account, take out the SIM, then have it properly wiped or its data destroyed.

Our personal data wipe service permanently removes LINE and social apps, banking apps, saved passwords, photos and ID card scans from phones, tablets, laptops and desktops, with a certificate for each device. You can choose a wipe-and-return, or have the data destroyed and the hardware donated or recycled, never resold. For single devices, see our phone data destruction and laptop data wipe pages. Ship to us from anywhere in Thailand, or request a pickup in Bangkok.

If the Fastwork notice made you think about how many copies of your ID card are still sitting on old devices, get an instant quote or call 082-797-3702, and we will make sure the next scammer who knows your name finds nothing more to work with.

Sources: Postjung, "Fastwork notifies personal data breach after 13 Oct cyberattack" (23 Oct 2026), summarising ChangeC Co., Ltd.'s breach notice of 22 Oct 2026.