Yeah I would still pursue this,
Your local police station will not be helpful though as this is beyond the scope of what they handle, if you would like to involve the police you can do so at the Technology Crime Supression Division, they are also located in Chaeng Wattana: https://tcsd.go.th/contact-us/?lang=en
I would start with the DPO above, from there you could possible just go 1-2-3 by reporting to the TCSD followed by reporting to PDPA with a copy of the police report and then following through with the OCPB.
You can basically contact/ submit complaints directly online so not really a lot of work stress of dealing with withstanding.
Understand for any company in thailand for a PDPA breach if they fail to report from discovery within 72 hours it is a 3 million baht fine, so either they are already aware of this or will need to report it once you contact them (they may not fully know?).
- under the PDPA law you have the right to a copy of your personal data or ask if there has been unauthorised collection of his/her personal data. (in the case they are aware) so just ask them may take a while to come but will make a case for reimburstment a lot easier
Lazada customer service is good (as per a lot or replies here) but I assume you are outside of the scope of thier operation, they just see your order never shipped, they don't understand that this is related to some other internal issue I would not try to bother following up with them but continue to follow through with the Data protection Officer (DPO) as the details in my previous post.
Once final thing, if you have your package tracking number with the delivery carrier, take screenshots of the tracking information per thier website as often it will be be discarded from the tracking website after around 90 days (dependant on carrier)