Thai government data pulled with stolen staff logins
In early August 2026 Thai officials confirmed that citizen data, including vehicle registration records on the prime minister and ministers, had been pulled from government systems using compromised staff accounts. The data was sold online, and the cabinet ordered password resets across more than 300 departments.
Key facts
- OrganisationThe Department of Land Transport (DLT) and agencies across 19 ministries and the Office of the Prime Minister, according to Domecloud CEO Thanarat Kuawattanaphan. The Department of Provincial Administration was also named.
- What happenedPolice say attackers logged in with compromised accounts of staff who had access rights, pulled data and sold it on the dark web, Telegram and Discord. Samples on prominent people were shown to prove the data was real.
- Data or systems affectedVehicle registration records, including on the prime minister and ministers, plus ID card photos and household data according to Thanarat. The DLT says the vehicle data is basic and cannot be used to make transactions.
- Cause or entry pointThe DLT says its main database was not hacked. Data was pulled through its read-only API, which 63 agencies use, with logins of three connected agencies, and Thanarat says most staff passwords were stolen by malware.
- ClaimedThanarat says data on more than 500,000 people across about 20 agencies was exposed. The Nation reports Discord bots sold searches at 350 baht a day or 2,500 baht a month.
- AuthoritiesThe DES Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints with cyber police. ThaiCERT was sent to the DLT, and the cabinet ordered password resets, a 15-day clean-up of old systems and multi-factor login.
Timeline
- 4 Aug 2026An adviser to the opposition leader said vehicle records, including the prime minister's car, could be searched online. DES Minister Chaichanok Chidchob ordered ThaiCERT to investigate with the DLT. The Nation
- 6 Aug 2026Deputy Transport Minister Siripong Angkasakulkiat said data was pulled through the DLT API with logins of connected agencies. The DLT cut access for three agencies, reset all API passwords and filed Computer Crime Act complaints. Thai PBS · The Nation
- 6 Aug 2026Cyber police questioned Domecloud CEO Thanarat Kuawattanaphan as a witness. Police said compromised staff accounts were used and the data was sold on the dark web, Telegram and Discord. Thairath
- 11 Aug 2026The cabinet ordered officials in more than 300 departments to change passwords, a 15-day review of about 30,000 systems and multi-factor login through ThaID or similar. Thansettakij
- 13 Aug 2026Police searched two homes in Phrae and Pathum Thani and seized computers. A juvenile suspect was questioned without detention, and no charges were reported. Thairath English
Affected organisations
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
| ✅ ConfirmedDepartment of Land Transport | 6 Aug 2026 | Transport | Data leak | None | Confirmed. Deputy Transport Minister Siripong Angkasakulkiat said vehicle registration data, including records on the prime minister and ministers, was pulled through the DLT API using credentials of connected agencies, and the DLT cut access for three agencies and filed Computer Crime Act complaints. Claimed. Search access to the data was sold through Discord bots at 350 baht a day or 2,500 baht a month. | Thai PBS · The Nation✓ 7 Nov |
| ✅ ConfirmedGovernment agencies in 19 ministries and the Office of the Prime Minister | 6 Aug 2026 | Government | Data leak | None | Confirmed. Cyber police said attackers used compromised staff accounts with access rights to pull citizen data from government systems and sold it on the dark web, Telegram and Discord; the Digital Economy Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints, and the cabinet ordered password resets across 300 departments. Claimed. Domecloud CEO Thanarat Kuawattanaphan said data on more than 500,000 people across about 20 agencies was exposed, mostly through staff passwords stolen by infostealer malware. | Thairath · The Nation · Thansettakij✓ 7 Nov |
What to do
- Hang up on callers who claim to be from a government agency, even if they know your details, and call the agency back on its official number.
- Ignore SMS messages with payment links that claim to be from the DLT or the Transport Ministry. Both say fines are sent only by post.
- Do not download, test or share the leaked data. The PDPC warns this can break the law.
- Report scam calls or messages to the police anti-online-scam hotline 1441 or at thaipoliceonline.go.th.
FAQ
Was the Department of Land Transport hacked?
The DLT says its main database was not hacked. Officials say the data was pulled through its read-only API using logins of three connected agencies, whose access was then cut.
What Thai government data was leaked?
Vehicle registration records, including on the prime minister and ministers, and according to Domecloud's CEO also ID card photos and household data from agencies across 19 ministries.
Has anyone been arrested over the Thai data leak?
No arrest had been reported by 13 August 2026. Police searched two homes, seized computers and questioned a juvenile without detaining him.
Related stories
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
Checked 7 Nov 2026. Methodology · Data CC BY 4.0