Thailand Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Thailand
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for Thailand, checked 7 Nov 2026. NCSA and ThaiCERT send alerts to agencies and critical infrastructure; the National Security Council said on 3 Nov it has a cyber response plan.
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
| Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
 Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| Incidents handled by ThaiCERT | 3,264 | January to September 2026 | ThaiCERT |
| ThaiCERT intrusion attempts | 1,138 | January to September 2026 | ThaiCERT |
| ThaiCERT fraud incidents | 529 | January to September 2026 | ThaiCERT |
| Online crime reports to the police reporting system | 221,626 | 1 January to 31 August 2026 | Thailand Edition (citing Technology Crime Suppression Division) |
| Reported online crime losses | Over 11,039 million baht | 1 January to 31 August 2026 | Thailand Edition (citing Technology Crime Suppression Division) |
| Losses by victims aged 60 and over | About 3,152 million baht (28.55% of losses) | 1 January to 31 August 2026 | Thailand Edition (citing Technology Crime Suppression Division) |
| Weekly Thai Police Online scam complaints | 6,060 complaints, THB260 million lost | 9 to 15 August 2026 | The Nation (citing ACSC) |
| Mule accounts closed | More than 351,000 | October 2025 to June 2026 | Xinhua (citing government spokesperson) |
| Scam-linked assets frozen | Over 3.6 billion baht | October 2025 to June 2026 | Xinhua (citing government spokesperson) |
| Scam suspects arrested | More than 29,000 | October 2025 to June 2026 | Xinhua (citing government spokesperson) |
| Youth mule accounts | 5,741 (up 70.3% from 3,371 in January 2025) | March 2026 | The Nation (citing Bank of Thailand) |
| Phone numbers suspended for suspected tech crime | 28,112 | January 2026 | Siam Rath (citing NBTC) |
| PDPA breach notifications received by PDPC | 1,650 (747 cyber, 849 non-cyber) | 2023 to 31 May 2026 | Today Variety (PDPC press briefing) |
| PDPA complaints received by PDPC | 4,210 (3,889 private sector, 321 public sector) | 2023 to 31 May 2026 | Today Variety (PDPC press briefing) |
| Online fraud cases and losses (consumer council count) | Over 170,000 cases, nearly THB9 billion | January to June 2026 | The Nation (citing Thailand Consumers Council) |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| The Gentlemen | Ransomware | Most active group on Thai victims in 2026 by leak-site count, listing universities, a provincial administration, Terminal 21, Amata and Museum Siam. | ransomware.live Thailand | Profile |
| Qilin | Ransomware | Listed Isuzu Motors Thailand, STOU and several Thai firms in 2026. | ransomware.live Thailand | Profile |
| LockBit 5.0 | Ransomware | Listed Major Cineplex and four other Thai firms on 20 June 2026, plus Thai Hua Rubber in March. | ransomware.live Thailand | Profile |
| Krybit | Ransomware | Listed the Bangkok Metropolitan Administration in May 2026 and several Thai manufacturers and printers. | ransomware.live | Profile |
| APT73 (Bashe) | Extortion | Listed Mahidol University in April and NARIT in May 2026. | ransomware.live Thailand | Profile |
| World Leaks | Extortion | Listed CH Karnchang in June 2026. | ransomware.live | Profile |
| Panzer | Ransomware | Listed The Minor Food Group and Siam Oil Product in August 2026. | ransomware.live Thailand | Profile |
| DragonForce | Ransomware | Listed Thai resorts and manufacturers between March and September 2026. | ransomware.live Thailand | Profile |
| Unnamed Chinese-speaking operators (Hermes agent, Hades backdoor) | State-aligned | Hunt.io linked an AI-agent-driven intrusion into the Finance Ministry in June and July 2026 to Chinese-speaking operators; no state attribution was made public by Thai officials. | The Record | |
| Government data resellers on Discord and Telegram | Scam syndicate | Police said sellers used stolen staff credentials to query government systems and sold lookups on the dark web, Telegram and Discord, with call centres the main buyers of concern. | Thairath · The Nation | |
| Gambling SEO network | Unattributed | The DSI arrested a suspect returning from Sihanoukville in January 2026 over government websites rigged to redirect to gambling sites. | LINE Today |
Laws and rules this year
- 11 Aug 2026Cabinet orders password reset, system cleanup and MFA across government. The cabinet ordered staff in more than 300 departments to reset passwords, required ministries to check over 30,000 systems and shut unused ones within 15 days, and mandated multi-factor authentication such as ThaID. Source
- 6 Aug 2026NCSA review of about 300 government departments. The government said the NCSA would assess about 300 departments within 30 days and push multi-factor authentication as a standard after the August data leaks. Source
- 2 Aug 2026Bank of Thailand caps digital transfers from minors' accounts. Daily caps of 3,000 to 10,000 baht by age apply to e-money and mobile banking for under 18s, with banks due by September 2026 and e-money providers by October 2026. Source
- 29 Jul 2026PDPC demands PDPA compliance evidence from Public Health Ministry and TSD. The PDPC asked both bodies to document breach scope, security controls and notifications, and said action could range from corrective orders to legal proceedings. Source
- 13 Jul 2026Source-of-funds declaration for large cash deposits. The government said cash deposits above 5 million baht would need a declaration of the source of funds starting in October 2026. Source
- 24 Apr 2026PDPC orders Council of Engineers to remedy breach. The PDPC ordered the council to fix the problem, limit damage and compensate those affected, and said it may refer the case for administrative penalties. Source
- 18 Feb 2026NBTC ghost SIM screening under its tech crime announcement. Under the NBTC announcement on preventing technology crime, carriers screen and suspend numbers with abnormal use and report results to the NBTC weekly. Source
Full stories
- Thai government data pulled with stolen staff logins Thailand · 6 Aug 2026
Official statements
- 6 Nov 2026The digital ministry asks regulator NBTC to order mobile operators to tighten defences after the NTT Docomo attack in Japan. Spacebar
- 3 Nov 2026The National Security Council says a cyber response plan is in place and calls agencies to a rehearsal on 4 Nov. Bangkok Insight
- 22 Oct 2026NCSA tells agencies, critical infrastructure and sector CERTs to patch PHP2Shell urgently and steps up monitoring. MGR Online
- 20 Oct 2026The PDPC said it had received 4,210 complaints and 1,650 breach notifications from 2023 to May 2026. PDPC via Today Variety
- 2 Sep 2026Cyber police said the online reporting system logged about 221,626 reports and over 11,039 million baht in losses from January to August. TCSD via Thailand Edition
- 11 Aug 2026The cabinet approved forced password resets, a 15-day cleanup of 30,000 systems and MFA across government. Government spokesperson via Thansettakij
- 6 Aug 2026The prime minister ordered an inquiry into leaked personal data, and the NCSA was told to review about 300 departments. Government spokesperson via Thai Post
- 6 Aug 2026The Deputy Transport Minister said DLT data leaked through misused API credentials, not a hack of the main database. Ministry of Transport via Thai PBS
- 29 Jul 2026The PDPC asked the Public Health Ministry and TSD for evidence of PDPA compliance. PDPC via Thai Post
- 28 Jul 2026TSD said about 200,000 Investor Portal accounts had personal data accessed through a profile page flaw. TSD via MGR Online
- 13 Jul 2026Government spokesperson Ratchada Thanadirek said more than 351,000 mule accounts were closed and over 3.6 billion baht frozen in nine months. Government spokesperson via Xinhua
- 24 Apr 2026The PDPC opened an inquiry into the Council of Engineers breach detected on 17 April. PDPC via Daily News
- 14 Apr 2026The Department of Provincial Administration filed complaints against three people who said its voter lookup data leaked. DOPA via Bangkok Biz News
- 26 Feb 2026The NBTC ordered carriers to suspend 495 SIMs registered with Chiang Mai students' data and sold to scam groups. NBTC via Thai PBS
- 18 Feb 2026The NBTC said it suspended 28,112 numbers suspected of tech crime use in January 2026, with Sa Kaeo highest at 7,331. NBTC via Siam Rath
- 17 Jan 2026The DSI arrested a suspect at Suvarnabhumi Airport over the hacking of 16 government websites to redirect to gambling sites. DSI via LINE Today
Incidents
42 of 42 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
| ✅ ConfirmedOpposition leaders (People's Party, Democrats) | 3 Nov 2026 | Other | Not disclosed | None | Confirmed. Natthaphong Ruengpanyawut posted an Apple spyware threat notification; Abhisit Vejjajiva also got one but his phone was not compromised. The government calls claims of state involvement baseless. | The Star · Naewna✓ 7 Nov |
 ⚠️ ClaimedBangkok Post | 30 Oct 2026 | Media | Data leak | Claimed. An actor claims a 6.9 GB dump with 822,140 member and 385 employee records. | Dark Web Informer✓ 7 Nov | |
 ⚠️ ClaimedXspring Capital | 29 Oct 2026 | Finance | Ransomware | Claimed. xspringcapital.com is listed on LockBit 5's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedWellington College International School Bangkok | 17 Oct 2026 | Education | Ransomware | Claimed. The Gentlemen listed Wellington College International School Bangkok on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedThai Ha PCL | 16 Oct 2026 | Manufacturing | Ransomware | Claimed. The SET-listed food maker is listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedMuseum Siam | 16 Oct 2026 | Other | Ransomware | Claimed. The Gentlemen listed Museum Siam on its leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedFastwork | 13 Oct 2026 | Other | Data leak | None | Confirmed. Fastwork said an attacker extracted national ID numbers, names, phone numbers and emails of some users on 13 October 2026, and that it notified the PDPC on 15 October. | Postjung News✓ 7 Nov |
 ⚠️ ClaimedRoyal Thai Air Force | 10 Oct 2026 | Government | Ransomware | Claimed. Listed on The Gentlemen's leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedThai Lion Air | 2 Oct 2026 | Transport | Ransomware | Claimed. Listed on Qilin's leak site with a threat to publish data. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPTT Oil and Retail Business (OR) | 2 Sep 2026 | Energy | Ransomware | Claimed. Listed on Dire Wolf's leak site with an extortion notice. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedAyudhya insurance (listed as AYUDHYA TH Insurance) | 20 Aug 2026 | Finance | Data leak | Claimed. Dysphor1a listed AYUDHYA TH Insurance on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedThe Minor Food Group | 10 Aug 2026 | Retail | Ransomware | Claimed. Panzer listed The Minor Food Group on its leak site. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedDepartment of Land TransportFull story | 6 Aug 2026 | Transport | Data leak | None | Confirmed. Deputy Transport Minister Siripong Angkasakulkiat said vehicle registration data, including records on the prime minister and ministers, was pulled through the DLT API using credentials of connected agencies, and the DLT cut access for three agencies and filed Computer Crime Act complaints. Claimed. Search access to the data was sold through Discord bots at 350 baht a day or 2,500 baht a month. | Thai PBS · The Nation✓ 7 Nov |
| ✅ ConfirmedGovernment agencies in 19 ministries and the Office of the Prime MinisterFull story | 6 Aug 2026 | Government | Data leak | None | Confirmed. Cyber police said attackers used compromised staff accounts with access rights to pull citizen data from government systems and sold it on the dark web, Telegram and Discord; the Digital Economy Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints, and the cabinet ordered password resets across 300 departments. Claimed. Domecloud CEO Thanarat Kuawattanaphan said data on more than 500,000 people across about 20 agencies was exposed, mostly through staff passwords stolen by infostealer malware. | Thairath · The Nation · Thansettakij✓ 7 Nov |
 ⚠️ ClaimedMinistry of Interior (volunteer registration database) | 4 Aug 2026 | Government | Data leak | None | Claimed. Thanarat Kuawattanaphan said high-resolution face photos of the prime minister, ministers and citizens leaked from a Ministry of Interior system used to register volunteers. | MGR Online · The Nation✓ 7 Nov |
| ⚠️ ClaimedOffice of the Vocational Education Commission | 4 Aug 2026 | Education | Data leak | None | Claimed. MGR Online reported a commission database holding data on about 2.5 million students protected only by the password 123456. | MGR Online✓ 7 Nov |
| ⚠️ ClaimedKatathani Phuket Beach Resort | 27 Jul 2026 | Other | Ransomware | Claimed. DragonForce listed Katathani Phuket Beach Resort on its leak site. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedThailand Securities Depository (TSD Investor Portal) | 25 Jul 2026 | Finance | Data leak | None | Confirmed. TSD said a flaw on its Investor Portal profile page let a logged-in user pull personal and account data of about 200,000 of more than 5 million accounts on 25 and 26 July 2026, and it reported the case to cyber police; the PDPC asked TSD for evidence of PDPA compliance. | MGR Online · Thai Post✓ 7 Nov |
| ✅ ConfirmedOnline game top-up and mobile credit platform (unnamed) | 18 Jul 2026 | Retail | Intrusion | None | Confirmed. The CCIB arrested a 26-year-old in Phuket on 18 July 2026 who police say manipulated a top-up platform's payment system in June and tried and failed to break into Royal Thai Police systems to erase his arrest warrants. | Thai Examiner · Khaosod English✓ 7 Nov |
 ⚠️ ClaimedMinistry of Finance | 15 Jul 2026 | Government | Intrusion | Unnamed, likely Chinese-speaking operators | Claimed. Hunt.io said attackers using the Hermes AI agent and a Hades backdoor compromised several ministry systems from mid to late June 2026 and that it notified ThaiCERT and the NCSA on 15 July; the ministry did not comment. | The Record✓ 7 Nov |
 ⚠️ ClaimedRoyal Thai Navy Housing Cooperative | 1 Jul 2026 | Finance | Ransomware | Claimed. The Gentlemen listed the Royal Thai Navy Housing Cooperative on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMajor Cineplex Group | 20 Jun 2026 | Media | Ransomware | Claimed. LockBit 5.0 listed majorcineplex.com on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedPublic health treatment-rights database | 10 Jun 2026 | Health | Data leak | None | Claimed. Domecloud CEO Thanarat Kuawattanaphan told a House committee that a health-rights database searchable by ID number covering about 67.1 million living and dead people was being sold cheaply; the PDPC later asked the Public Health Ministry to explain its Mor Prom system after more than 30 complaints. | Naewna · Thai Post✓ 7 Nov |
 ⚠️ ClaimedIsuzu Motors (Thailand) | 8 Jun 2026 | Manufacturing | Ransomware | Claimed. Qilin listed Isuzu Motors (isuzu-motors.co.th) on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedCH Karnchang PCL | 5 Jun 2026 | Property | Data leak | Claimed. World Leaks listed CH Karnchang on its extortion site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedThoresen Thai Agencies | 4 Jun 2026 | Transport | Ransomware | Claimed. The Gentlemen listed Thoresen Thai Agencies on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedBangkok Metropolitan Administration | 23 May 2026 | Government | Ransomware | Claimed. Krybit listed bangkok.go.th on its leak site and threatened to publish government data. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedNational Astronomical Research Institute of Thailand | 21 May 2026 | Government | Data leak | Claimed. APT73 listed narit.or.th on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedMahidol University | 27 Apr 2026 | Education | Data leak | Claimed. APT73 listed mahidol.ac.th on its leak site. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedCouncil of Engineers Thailand | 17 Apr 2026 | Other | Data leak | None | Confirmed. The Council of Engineers said it detected a breach of member data on 17 April 2026, contained it and notified the PDPC, which opened an inquiry and ordered it to remedy the damage. Claimed. A council board member said data on more than 300,000 members had reached fraudsters; the council has not stated a final count. | Daily News · DataBreaches.net (citing Bangkok Post) · Prachachat✓ 7 Nov |
| ⚠️ ClaimedTerminal 21 | 4 Apr 2026 | Retail | Ransomware | Claimed. The Gentlemen listed Terminal 21 on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedThai Hua Rubber PCL | 30 Mar 2026 | Manufacturing | Ransomware | Claimed. LockBit 5.0 listed thaihua.com on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedPayap University | 16 Mar 2026 | Education | Ransomware | Claimed. The Gentlemen listed Payap University on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedThai Solar Energy PCL | 14 Mar 2026 | Energy | Ransomware | Claimed. Payload listed Thai Solar Energy on its leak site. | ransomware.live✓ 7 Nov | |
| ✅ ConfirmedSchools in Mae Ai district, Chiang Mai | 26 Feb 2026 | Education | Not disclosed | Confirmed. The NBTC said people posing as mobile carrier staff used students' ID card scans and face images to register 495 SIM cards for scam groups, and it ordered carriers to suspend them. | Thai PBS✓ 7 Nov | |
 ⚠️ ClaimedAmata Corporation PCL | 26 Feb 2026 | Property | Ransomware | Claimed. The Gentlemen listed Amata on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedRuamjairak Hospital | 24 Feb 2026 | Health | Ransomware | Claimed. The Gentlemen listed Ruamjai (ruamjaimedical.co.th) on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedDepartment of Provincial Administration (voter eligibility lookup) | 15 Feb 2026 | Government | Data leak | None | Claimed. IT specialist Thanarat Kuawattanaphan said the election voter lookup exposed ID numbers, first names and ballot list numbers nationwide until a fix on 14 February 2026; the DOPA called the claim inaccurate and filed defamation and Computer Crime Act complaints on 10 April. | MGR Online · Bangkok Biz News✓ 7 Nov |
 ⚠️ ClaimedThammasat University | 11 Feb 2026 | Education | Ransomware | Claimed. The Gentlemen listed Thammasat University on its leak site. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedChonburi Provincial Administration | 6 Feb 2026 | Government | Ransomware | Claimed. The Gentlemen listed a Chonburi provincial administration (chon.go.th) on its leak site. | ransomware.live✓ 7 Nov | |
 ⚠️ ClaimedSukhothai Thammathirat Open University | 27 Jan 2026 | Education | Ransomware | Claimed. Qilin listed STOU (stou.ac.th) on its leak site. | ransomware.live✓ 7 Nov | |
| ✅ Confirmed16 government agency websites | 17 Jan 2026 | Government | SEO poisoning | Confirmed. The DSI arrested a suspect at Suvarnabhumi Airport on 17 January 2026 in a special case over the hacking of 16 government agency websites that were made to redirect visitors to online gambling sites. | LINE Today✓ 7 Nov |
FAQ
Does Thailand have a national cyber threat level?
No published national cyber threat level was found for Thailand (checked 7 Nov 2026). NCSA and ThaiCERT send alerts to agencies and critical infrastructure; the National Security Council said on 3 Nov it has a cyber response plan.
Which organisations in Thailand confirmed cyber incidents recently?
9 incidents confirmed since January 2026: Opposition leaders (People's Party, Democrats), Fastwork, Department of Land Transport, Government agencies in 19 ministries and the Office of the Prime Minister, Thailand Securities Depository (TSD Investor Portal), Online game top-up and mobile credit platform (unnamed), Council of Engineers Thailand, Schools in Mae Ai district, Chiang Mai and 16 government agency websites.
Which Thailand organisations appear on ransomware or leak sites?
33 claims, not confirmed by the organisations: Bangkok Post, Xspring Capital, Wellington College International School Bangkok, Thai Ha PCL, Museum Siam, Royal Thai Air Force, Thai Lion Air and PTT Oil and Retail Business (OR) and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.