State data leaks deepen Thailand’s cyber-security crisis

Thai authorities have launched a cross-agency investigation into unauthorised access to government databases after personal information linked to members of the public, the prime minister, cabinet ministers and senior officials appeared online.

The latest incident involved vehicle-registration information held by the Department of Land Transport (DLT), renewing questions over whether government agencies have adequate safeguards for personal data.

It followed an earlier incident in which information involving about 200,000 investors was exposed from more than five million shareholder accounts maintained by Thailand Securities Depository Co Ltd.

PDPC distinguishes access offence from conventional leak

Police Colonel Surapong Plengkham, secretary-general of the Personal Data Protection Committee (PDPC), said the agency immediately coordinated with relevant authorities after receiving a report about the DLT case. 

The preliminary investigation indicated that fraud networks had unlawfully created and circulated data or channels providing access to protected databases.

The conduct appeared more consistent with unauthorised access to protected computer data under Section 7 of the Computer Crime Act than with a database leak in the conventional sense, he said.

The PDPC nevertheless acknowledged the need to protect the public by identifying the source of the information, determining how the systems were accessed and tracing networks involved in the illegal trade in personal data.

Three levels of enforcement

The PDPC divided its response into three areas:

• Downstream: People who post or distribute personal information or links providing unauthorised database access may breach the Computer Crime Act. The PDPC is coordinating with the Ministry of Digital Economy and Society and other agencies on legal action.
• Upstream: The DLT and the Department of Provincial Administration, as the agencies responsible for the data, have been instructed to establish the facts, contain the incidents, report personal-data breaches to the PDPC and strengthen system security. They are also working with the National Cyber Security Agency (NCSA) to close vulnerabilities and establish baseline security standards for government agencies.
• Midstream: Authorities are targeting networks that sell personal information or unauthorised access to systems, creating an illicit market for government data. The PDPC is coordinating with the Digital Economy and Society Ministry and the Central Investigation Bureau to investigate suspects, make arrests and close illegal trading channels.

The PDPC also warned members of the public, page administrators and social-media users not to test, download, forward or republish the information because doing so could constitute an offence.

Single IP address used for two logins

Digital Economy and Society Minister Chaichanok Chidchob said investigators had so far found no evidence that the DLT system had been hacked directly.

Instead, access was traced to one IP address and an account that had been used to log in twice before the information was disclosed.

The investigation was continuing, and the ministry would not yet disclose the IP address’s location or additional technical details to avoid inaccurate conclusions, he said.

The access channel had been closed, preventing further information from being obtained through the same route.

Chaichanok, who also chairs the Cybersecurity Regulatory Committee, ordered the NCSA to deploy a ThaiCERT team to the DLT.

Investigators are collecting evidence, analysing technical information, tracing the origin of the data and assessing the impact through digital forensics.

Deputy Digital Economy and Society Minister Nan Boonthida Somchai said publishing personal information on social media could enable scammers to use it in online crimes. 

The ministry instructed the PDPC and NCSA to investigate and consider filing a complaint with the Cyber Crime Investigation Bureau under the Computer Crime Act.

Nan warned that publishing illegal information online could fall under Section 14 of the act, carrying a maximum penalty of five years’ imprisonment, a fine of up to 100,000 baht or both.

ThaiCERT examines APIs and connected agencies

Deputy Transport Minister Siripong Angkasakulkiat said ThaiCERT personnel had been stationed at the DLT to collect information and conduct technical examinations using digital-forensics procedures.

Investigators were also tracing application programming interface, or API, activity with agencies connected to the department’s databases. 

The DLT confirmed that the disclosed information was genuine but said it consisted of basic data that could not be used to conduct other transactions.

It warned that anyone who redistributed the information could face legal proceedings.

Illicit data services operate through Discord bots

Thanarat Kuawattanaphan, chief executive of DomeCloud, said the illegal trade in personal information was not new.

He said the problem had become prominent around the election period, when lists of eligible voters were found being traded. Vehicle-registration databases had then been clearly offered for sale during the past three months.

Information involving prominent people was often displayed as a sample to demonstrate that a database contained genuine records before access was offered to customers, he said.

Illegal operators had developed Discord bots through which paying customers could search for information.

The reported charges were:

• 350 baht per day
• 2,500 baht per month
• Unlimited searches

Thanarat described the operation as the conversion of government-held information into a commercial service in an illicit market, with low fees allowing many criminals to gain access.

He said the vehicle-registration records identified in the case came directly from a DLT system rather than from a public or private agency connected to the department.

Information associated with the Department of Provincial Administration had similarly been traced to the department’s own website, he added.

Password-only systems remain vulnerable

Thanarat said the problem was not necessarily that government agencies lacked security systems, but that their levels of protection did not reflect the sensitivity of the information they held.

Many systems continued to rely only on a username and password. An attacker could gain immediate access to large volumes of personal information if an official’s computer became infected with malware or login credentials were stolen.

Unused or outdated systems also remained important points of vulnerability.

On June 10, Thanarat published the results of checks comparing the domains of ministries and equivalent agencies with a tool used to search leaked-account data.

The findings included:

• Ministry of Interior: 500,000 records
• Ministry of Education: 500,000 records
• Ministry of Labour: 359,535 records
• Ministry of Public Health: 212,460 records
• Office of the Prime Minister: 198,984 records
• Ministry of Defence: 170,667 records
• Ministry of Justice: 151,626 records
• Ministry of Finance: 107,456 records

The figures for the Interior and Education ministries reached the maximum number of results displayed by the search tool.

More than 90% of the passwords identified were old and could no longer be used on current systems, he said. Some agencies had already moved to ThaID or other authentication systems.

Old credentials could still present risks because attackers might use them to guess new passwords, conduct targeted phishing or locate old accounts that had not been deactivated.

Exposed facial images linked to volunteer database

Thanarat said the disclosure of facial images involving senior figures did not indicate that information covering the entire population had been exposed.

The exact number of affected people was still being assessed.

Initial findings suggested that the records came from a database used to register participants in volunteer activities. Those potentially affected were mainly civil servants and some students who had previously registered.

Agencies urged to adopt ThaID

Thanarat recommended that state agencies inspect all systems to identify those that had not been upgraded or used within the past five years.

Systems that were no longer necessary should be closed to reduce attack routes involving outdated software or infrastructure that could no longer be maintained effectively, he said.

Services still in use should urgently adopt ThaID as an additional authentication mechanism rather than relying solely on usernames and passwords.

He estimated that adding ThaID verification could reduce system attacks by about 90%, as most illegal data services uncovered so far had relied on the same weakness: stolen user passwords being used to enter systems without authorisation.

In the longer term, the government would need to improve its national identity-verification infrastructure so that it could support large numbers of simultaneous users.

Existing services, including the ThaID application, could experience disruptions or outages during periods of heavy demand, he said. System capacity would therefore need to be expanded alongside stronger protection for government databases.

Source: Bangkokbiznews