Thai cyber team probes alleged leak of vehicle registration data
ThaiCERT is investigating claims that vehicle registration searches exposed Department of Land Transport data linked to Thailand’s prime minister and Interior Ministry officials.
- The Thai government is investigating claims that personal data from the Department of Land Transport was leaked and made accessible on an unauthorized website using vehicle registration numbers.
- The alleged data breach reportedly exposed the personal details of high-ranking officials, including Prime Minister Anutin Charnvirakul, whose information was accessed via his car's registration number.
- Thailand's National Cyber Security Agency is working with the transport department to verify the claims, trace the source of the leak, and assess the potential impact through digital forensics.
- A cybersecurity expert has claimed the data may have been leaking for at least five years and warned that the exposed information, including ID card photos and numbers, could be used for identity fraud.
Digital Economy and Society Minister Chaichanok Chidchob on Tuesday (August 4) ordered an urgent investigation into claims that Department of Land Transport records had been made accessible through an unauthorised website.
The investigation followed a disclosure by Nitikorn Bunyakulcharoen, an adviser to the opposition leader in the House of Representatives and a former People’s Party party-list candidate.
Nitikorn claimed that information linked to the department could be retrieved from the website by entering a vehicle registration number. He also alleged that a search using the registration number of Prime Minister Anutin Charnvirakul’s private car returned personal details.
Chaichanok, who chairs the Cybersecurity Regulating Committee, instructed the National Cyber Security Agency to assign the Thailand Computer Emergency Response Team, or ThaiCERT, to work with the Department of Land Transport.
The department, as the owner of the system, and ThaiCERT are collecting information, verifying the claims, examining technical evidence and attempting to trace the source of the records.
Digital forensics is also being used to assess the potential scale and impact of the incident. The inquiry is being conducted on the basis of accuracy, transparency and verifiable technical evidence.
No conclusion has yet been reached on either the cause of the alleged exposure or the source of the information.
The NCSA and the Department of Land Transport will continue their joint investigation before proposing preventive measures and appropriate security improvements. The aim is to strengthen the protection of personal data and reduce the risk of future cyber threats.
Expert claims data leak may date back at least five years
Thanarat Kuawattanaphan, CEO of DomeCloud, separately claimed that personal data held by the Interior Ministry had also been exposed. According to Thanarat, the affected records included information linked to Anutin in his capacity as interior minister, as well as two deputy interior ministers.
He alleged that records relating to senior ministry officials had also been exposed, including those of the permanent secretary, deputy permanent secretaries, the director-general of the Department of Provincial Administration and deputy director-generals.
Thanarat claimed that the exposed files contained personal information and photographs taken from national identity cards.
He noted that the people whose records had allegedly been exposed included personal data controllers, officials responsible for supervising compliance with the Personal Data Protection Act (PDPA), and individuals able to influence government policy.
“If they are victims themselves and the PDPA still cannot be enforced, there is little hope for the country,” he wrote.
Thanarat also questioned what proactive action the PDPC Eagle Eye unit had taken, arguing that a lack of visible enforcement following a leak of this scale would undermine the unit’s purpose and waste public money.
“The PDPA must carry weight and be enforced consistently,” he wrote, adding that there were grounds to believe the information had been leaking for at least five years, leaving it open to extensive misuse by fraudsters.
Thanarat expressed hope that the secretary-general of the Personal Data Protection Committee would not be as lenient as he believed the authorities had been in previous cases.
He warned that the exposed information could be edited to create fabricated copies of identity cards because the records contained 13-digit identification numbers, full names, dates of birth, registered addresses and identity-card photographs.
Other details could then be added without proper verification, potentially allowing the documents to be misused in subsequent transactions, he claimed.
