Tech CEO Reports Data Breach to Cyber Police, Denies Political Motive
A tech CEO reported a massive data breach affecting over 500,000 Thai citizens to cyber police, claiming he disclosed officials' data only after authorities ignored his warnings for two months, not for political reasons.
On August 6, Thanarat Kuvattanapan, CEO of Dome Cloud, presented information to Cyber Crime Police Division 1 at the Government Center regarding the discovery of widespread personal data leakage affecting ID photos, vehicle registrations, and information belonging to prime ministers, cabinet ministers, and hundreds of thousands of ordinary citizens. Officers from the division, including Deputy Police General Sirivat Deepho and other senior investigators, conducted the questioning.
Thanarat revealed that he had previously provided phone-based information and expressed surprise at being summoned, fearing it might lead to legal action. However, he emphasized that the data disclosure stemmed from repeated unsuccessful attempts to alert relevant authorities over more than two months, including filing complaints through digital committees and government agencies. Frustrated by the lack of response, he decided to release information about high-ranking officials to raise awareness, denying any political intent.
The data breach spans 19 ministries and the Prime Minister's Office, with particular vulnerability in the Interior Ministry and Education Ministry affecting 20 agencies. Thanarat disclosed that over 500,000 Thai citizens' data has been compromised, primarily due to leaked employee passwords from malware-infected computers rather than direct system hacking. Leaked credentials were collected and sold; buyers then attempted system access and, upon finding valuable data, created APIs to extract and resell information.
Data accessible from the health database includes national ID numbers, house registration details, parents' ID numbers enabling family mapping, vehicle registration, and facial photographs. Thanarat questioned government agencies' data protection standards, noting that problems extend beyond weak passwords to unnecessary data retention, with some information stored over five years before leaking. High-ranking officials' data is often used as premium samples to increase resale value.
Addressing Digital Economy Minister Chaichanok Chidchob's suggestion of political motivation, Thanarat acknowledged understanding such concerns given that disclosed personnel worked under agencies overseen by the Bhumjaithai Party, but firmly denied political intent. He stated readiness to face legal action from the Department of Local Administration and acknowledged previous complaints regarding voter data leaks. The investigation began with security checks of the ballot card system after receiving information about voter registry sales, which prompted broader investigation revealing the extensive data breach.
