Officials Identify Three Suspicious IPs in Data Leak Case
Three suspicious IP addresses linked to government accounts were identified in a data breach affecting Thailand's Department of Land Transport, with authorities suspecting compromised credentials or hacked accounts affected roughly 6,000 to
At a press conference at Government House on August 5, Transport Deputy Minister Siripon Angkhskulgiat disclosed that three suspicious IP addresses from government accounts have been detected in the data breach affecting the Department of Land Transport. The accounts showed abnormal data access patterns and search behavior, prompting the ministry to report the matter to the Cyber Police Office. The three suspicious IP addresses originated from Bangkok Noi District Office, Expressway Authority of Thailand, and the Thai Armed Forces, whose accounts have been temporarily suspended.
All government agencies that request data from the Transport Ministry and Department of Land Transport have been instructed to reset their passwords to clear any compromised credentials. Officials have not yet determined whether the data was accessed by legitimate account holders, stolen credentials, or hacked accounts. The complete list of suspects has been handed over to police for prosecution.
Deputy Minister Siripon assured the public that the leaked personal information is basic data that cannot be used for any financial transactions or property transfers. The ministry has blocked all access channels, though individuals with Dark Web access may still view the data being sold illegally. He emphasized that the ministry would never contact residents unsolicited or send links of any kind, and urged people not to panic as the compromised data cannot be used fraudulently without additional identity verification.
When asked about the scale of the breach, Siripon stated that abnormal searches affected approximately 6,000 to 7,000 people, with some accounts conducting around 2,000 searches. Regarding suspicions that high-profile individuals' data was specifically targeted, he noted that the unusual search behavior patterns warrant police investigation. When asked whether the breach was linked to Dark Web markets selling tokens for data access, Siripon suggested it was likely part of the operation but deferred to police to determine if political motivations were involved.
