https://pwnsy.com/tools/cyber-watch/thailand/Sourced cyber incidents and official statements, from pwnsy Cyber Watch.enSun, 08 Nov 2026 00:00:00 +0000https://spacebar.th/business/docomo-outage-thai-telecom87e82da2f10a14b1Fri, 06 Nov 2026 00:00:00 +0000The digital ministry asks regulator NBTC to order mobile operators to tighten defences after the NTT Docomo attack in Japan.https://pwnsy.com/tools/cyber-watch/thailand/#all997d692ee9293c4dTue, 03 Nov 2026 00:00:00 +0000Natthaphong Ruengpanyawut posted an Apple spyware threat notification; Abhisit Vejjajiva also got one but his phone was not compromised. The government calls claims of state involvement baseless. Sources: https://www.thestar.com.my/aseanplus/aseanplus-news/2026/11/04/thai-opposition-leader-targeted-in-spyware-attack-party, https://www.naewna.com/n/politics/147878/https://www.thebangkokinsight.com/news/politics-general/1716325/98d972df7eb64da7Tue, 03 Nov 2026 00:00:00 +0000The National Security Council says a cyber response plan is in place and calls agencies to a rehearsal on 4 Nov.https://pwnsy.com/tools/cyber-watch/thailand/#all7413820bb842b58eFri, 30 Oct 2026 00:00:00 +0000An actor claims a 6.9 GB dump with 822,140 member and 385 employee records. Sources: https://darkwebinformer.com/bangkok-post-breach-claim-includes-822-140-member-accounts-and-6-9-gb-infrastructure-dump/https://pwnsy.com/tools/cyber-watch/thailand/#alld0054d31dc847029Thu, 29 Oct 2026 00:00:00 +0000xspringcapital.com is listed on LockBit 5's leak site. Sources: https://www.ransomware.live/id/eHNwcmluZ2NhcGl0YWwuY29tQGxvY2tiaXQ1https://mgronline.com/politics/detail/96900001021507e3497a41b2bf098Thu, 22 Oct 2026 00:00:00 +0000NCSA tells agencies, critical infrastructure and sector CERTs to patch PHP2Shell urgently and steps up monitoring.https://www.todayvariety.com/2026/10/pdpa-4210-1650.htmlbaff57abf6044083Tue, 20 Oct 2026 00:00:00 +0000The PDPC said it had received 4,210 complaints and 1,650 breach notifications from 2023 to May 2026.https://pwnsy.com/tools/cyber-watch/thailand/#all71128a3a0614af2aSat, 17 Oct 2026 00:00:00 +0000The Gentlemen listed Wellington College International School Bangkok on its leak site. Sources: https://www.ransomware.live/id/V2VsbGluZ3RvbiBDb2xsZWdlIEludGVybmF0aW9uYWwgU2Nob29sIEJhbmdrb2tAdGhlZ2VudGxlbWVuhttps://pwnsy.com/tools/cyber-watch/thailand/#allc31aae7b0f8a7009Fri, 16 Oct 2026 00:00:00 +0000The SET-listed food maker is listed on The Gentlemen's leak site. Sources: https://www.ransomware.live/id/VGhhaSBIYSBQQ0wgS0FTRVRAdGhlZ2VudGxlbWVuhttps://pwnsy.com/tools/cyber-watch/thailand/#allbc5f9edbffb680faFri, 16 Oct 2026 00:00:00 +0000The Gentlemen listed Museum Siam on its leak site. Sources: https://www.ransomware.live/id/TXVzZXVtIFNpYW1AdGhlZ2VudGxlbWVuhttps://pwnsy.com/tools/cyber-watch/thailand/#all95513147937efb0cTue, 13 Oct 2026 00:00:00 +0000Fastwork said an attacker extracted national ID numbers, names, phone numbers and emails of some users on 13 October 2026, and that it notified the PDPC on 15 October. Sources: https://news.postjung.com/1729610https://pwnsy.com/tools/cyber-watch/thailand/#all77579ecbaa126525Sat, 10 Oct 2026 00:00:00 +0000Listed on The Gentlemen's leak site. Sources: https://www.ransomware.live/id/Um95YWwgVGhhaSBBaXIgRm9yY2VAdGhlZ2VudGxlbWVuhttps://pwnsy.com/tools/cyber-watch/thailand/#allbf090d5a394a75b5Fri, 02 Oct 2026 00:00:00 +0000Listed on Qilin's leak site with a threat to publish data. Sources: https://www.ransomware.live/id/VGhhaSBMaW9uIEFpckBxaWxpbghttps://pwnsy.com/tools/cyber-watch/thailand/#allc84e0d8122d36a32Wed, 02 Sep 2026 00:00:00 +0000Listed on Dire Wolf's leak site with an extortion notice. Sources: https://www.ransomware.live/id/UFRUIE9pbCBhbmQgUmV0YWlsIEJ1c2luZXNzQGRpcmV3b2xmhttps://thailandedition.com/i/cyber-police-retirees-lose-315-billion-baht-scams-00a26a97d1686b2e930c400d1c3a6dcff040cfe6Wed, 02 Sep 2026 00:00:00 +0000Cyber police said the online reporting system logged about 221,626 reports and over 11,039 million baht in losses from January to August.https://pwnsy.com/tools/cyber-watch/thailand/#allb318a60ad0779d98Thu, 20 Aug 2026 00:00:00 +0000Dysphor1a listed AYUDHYA TH Insurance on its leak site. Sources: https://www.ransomware.live/id/QVlVREhZQSBUSCBJbnN1cmFuY2VARFlTUEhPUjFBhttps://www.thansettakij.com/economy/66619550dd800898d47037Tue, 11 Aug 2026 00:00:00 +0000The cabinet approved forced password resets, a 15-day cleanup of 30,000 systems and MFA across government.https://pwnsy.com/tools/cyber-watch/thailand/#all17e91e85426ab9c4Mon, 10 Aug 2026 00:00:00 +0000Panzer listed The Minor Food Group on its leak site. Sources: https://www.ransomware.live/id/VGhlIE1pbm9yIEZvb2QgR3JvdXBAUGFuemVyhttps://pwnsy.com/tools/cyber-watch/thailand/#allfc3133e099da9fc2Thu, 06 Aug 2026 00:00:00 +0000Deputy Transport Minister Siripong Angkasakulkiat said vehicle registration data, including records on the prime minister and ministers, was pulled through the DLT API using credentials of connected agencies, and the DLT cut access for three agencies and filed Computer Crime Act complaints. Search access to the data was sold through Discord bots at 350 baht a day or 2,500 baht a month. Sources: https://www.thaipbs.or.th/news/content/509122, https://www.nationthailand.com/news/general/40069456https://pwnsy.com/tools/cyber-watch/thailand/#all6d6d087a368e42fcThu, 06 Aug 2026 00:00:00 +0000Cyber police said attackers used compromised staff accounts with access rights to pull citizen data from government systems and sold it on the dark web, Telegram and Discord; the Digital Economy Ministry, the Interior Ministry and the Department of Provincial Administration filed complaints, and the cabinet ordered password resets across 300 departments. Domecloud CEO Thanarat Kuawattanaphan said data on more than 500,000 people across about 20 agencies was exposed, mostly through staff passwords stolen by infostealer malware. Sources: https://www.thairath.co.th/news/crime/2951036, https://www.nationthailand.com/news/general/40069456, https://www.thansettakij.com/economy/666195https://www.thaipost.net/politics-news/1045444/7136ab1d550a0bd8Thu, 06 Aug 2026 00:00:00 +0000The prime minister ordered an inquiry into leaked personal data, and the NCSA was told to review about 300 departments.https://www.thaipbs.or.th/news/content/50912201edbfad47bbc09eThu, 06 Aug 2026 00:00:00 +0000The Deputy Transport Minister said DLT data leaked through misused API credentials, not a hack of the main database.https://pwnsy.com/tools/cyber-watch/incidents/thailand-government-data-leak/a12b9aecbbed1afdThu, 06 Aug 2026 00:00:00 +0000In August 2026 Thai citizen data, including vehicle records on the PM, was pulled from state systems with staff logins and sold on Discord and Telegram.https://pwnsy.com/tools/cyber-watch/thailand/#all1215f9e13eaaf328Tue, 04 Aug 2026 00:00:00 +0000Thanarat Kuawattanaphan said high-resolution face photos of the prime minister, ministers and citizens leaked from a Ministry of Interior system used to register volunteers. Sources: https://mgronline.com/stockmarket/detail/9690000076472, https://www.nationthailand.com/news/general/40069456https://pwnsy.com/tools/cyber-watch/thailand/#alldc88b445b0ce30d2Tue, 04 Aug 2026 00:00:00 +0000MGR Online reported a commission database holding data on about 2.5 million students protected only by the password 123456. Sources: https://mgronline.com/stockmarket/detail/9690000076472https://www.thaipost.net/economy-news/1040694/4fd33ea261934800Wed, 29 Jul 2026 00:00:00 +0000The PDPC asked the Public Health Ministry and TSD for evidence of PDPA compliance.https://mgronline.com/stockmarket/detail/969000007406896bfcda9fc2eac18Tue, 28 Jul 2026 00:00:00 +0000TSD said about 200,000 Investor Portal accounts had personal data accessed through a profile page flaw.https://pwnsy.com/tools/cyber-watch/thailand/#all9500002d12005bd1Mon, 27 Jul 2026 00:00:00 +0000DragonForce listed Katathani Phuket Beach Resort on its leak site. Sources: https://www.ransomware.live/id/S2F0YXRoYW5pIFBodWtldCBCZWFjaCBSZXNvcnRAZHJhZ29uZm9yY2Uhttps://pwnsy.com/tools/cyber-watch/thailand/#allacac7c3c7c2f519bSat, 25 Jul 2026 00:00:00 +0000TSD said a flaw on its Investor Portal profile page let a logged-in user pull personal and account data of about 200,000 of more than 5 million accounts on 25 and 26 July 2026, and it reported the case to cyber police; the PDPC asked TSD for evidence of PDPA compliance. Sources: https://mgronline.com/stockmarket/detail/9690000074068, https://www.thaipost.net/economy-news/1040694/https://pwnsy.com/tools/cyber-watch/thailand/#all323254d71463534aSat, 18 Jul 2026 00:00:00 +0000The CCIB arrested a 26-year-old in Phuket on 18 July 2026 who police say manipulated a top-up platform's payment system in June and tried and failed to break into Royal Thai Police systems to erase his arrest warrants. Sources: https://www.thaiexaminer.com/thai-news-foreigners/2026/07/19/self-taught-thai-hacker-learned-the-trade-to-access-police-data-systems-and-wipe-his-own-arrest-warrants/, https://www.khaosodenglish.com/news/crimecourtscalamity/2026/07/19/grade-6-educated-hacker-tried-to-erase-own-arrest-warrants-police-say/https://pwnsy.com/tools/cyber-watch/thailand/#all9e9322adf8e65bb4Wed, 15 Jul 2026 00:00:00 +0000Hunt.io said attackers using the Hermes AI agent and a Hades backdoor compromised several ministry systems from mid to late June 2026 and that it notified ThaiCERT and the NCSA on 15 July; the ministry did not comment. Sources: https://therecord.media/thailand-hackers-ai-finance-ministryhttps://english.news.cn/20260713/8afa7a37ce1e4a2ea37bd12ee394d8be/c.htmld004195282d902dbMon, 13 Jul 2026 00:00:00 +0000Government spokesperson Ratchada Thanadirek said more than 351,000 mule accounts were closed and over 3.6 billion baht frozen in nine months.https://pwnsy.com/tools/cyber-watch/thailand/#all1c3374fbfdf7812bWed, 01 Jul 2026 00:00:00 +0000The Gentlemen listed the Royal Thai Navy Housing Cooperative on its leak site. Sources: https://www.ransomware.live/id/Um95YWwgVGhhaSBOYXZ5IEhvdXNpbmcgQ29vcGVyYXRpdmVAdGhlZ2VudGxlbWVuhttps://pwnsy.com/tools/cyber-watch/thailand/#all59b527621b86a13cSat, 20 Jun 2026 00:00:00 +0000LockBit 5.0 listed majorcineplex.com on its leak site. Sources: https://www.ransomware.live/id/bWFqb3JjaW5lcGxleC5jb21AbG9ja2JpdDUhttps://pwnsy.com/tools/cyber-watch/thailand/#all8d2fef4e48e1a2f3Wed, 10 Jun 2026 00:00:00 +0000Domecloud CEO Thanarat Kuawattanaphan told a House committee that a health-rights database searchable by ID number covering about 67.1 million living and dead people was being sold cheaply; the PDPC later asked the Public Health Ministry to explain its Mor Prom system after more than 30 complaints. Sources: https://www.naewna.com/politic/969902, https://www.thaipost.net/economy-news/1040694/https://pwnsy.com/tools/cyber-watch/thailand/#all36a2308108dacf20Mon, 08 Jun 2026 00:00:00 +0000Qilin listed Isuzu Motors (isuzu-motors.co.th) on its leak site. Sources: https://www.ransomware.live/id/SXN1enUgTW90b3JzQHFpbGluhttps://pwnsy.com/tools/cyber-watch/thailand/#allefce6da87d9651dcFri, 05 Jun 2026 00:00:00 +0000World Leaks listed CH Karnchang on its extortion site. Sources: https://www.ransomware.live/id/Q0ggS2FybmNoYW5nIFB1YmxpY0B3b3JsZGxlYWtzhttps://pwnsy.com/tools/cyber-watch/thailand/#allf63d9d1405434491Thu, 04 Jun 2026 00:00:00 +0000The Gentlemen listed Thoresen Thai Agencies on its leak site. Sources: https://www.ransomware.live/id/VGhvcmVzZW4gVGhhaSBBZ2VuY2llc0B0aGVnZW50bGVtZW4https://pwnsy.com/tools/cyber-watch/thailand/#all13b65eae823ee247Sat, 23 May 2026 00:00:00 +0000Krybit listed bangkok.go.th on its leak site and threatened to publish government data. Sources: https://www.ransomware.live/id/YmFuZ2tvay5nby50aEBrcnliaXQhttps://pwnsy.com/tools/cyber-watch/thailand/#all86ea3d4b526ed9ddThu, 21 May 2026 00:00:00 +0000APT73 listed narit.or.th on its leak site. Sources: https://www.ransomware.live/id/bmFyaXQub3IudGhAYXB0NzM