- A vendor on the dark web claims to have 538,415 records of phones from people in Thailand, which includes their name, ID number, phone, and home address.
- If this information is real, it will allow criminals to take over people’s phones by using another person’s SIM card (sim-swap), con someone into giving up their account information (phishing), or even create a false identity through someone’s information (identity theft).
- Security experts still haven’t confirmed whether the information they received is true or what the source is for these claims, so no one knows yet if this happened in Thailand.
An underground forum has a post from a hacker selling a large database of phone records from Thailand. The hacker claims that the database has thousands of pieces of personal information belonging to citizens in Thailand.
According to the hacker’s post on the dark web, the database contains full names, national ID codes, phone numbers, and residential addresses. He states that there are about 538,415 records within the database. The hacker provides samples of these records in order to demonstrate that he actually possesses them.
The amount of information stolen is considered extremely valuable to criminals, as it contains identity documentation along with a phone number that could lead to many different types of fraud and scams. Having such personal information makes it easier for attackers to increase their chances of targeting victims.
Stolen Data Could Fuel Multiple Types of Fraud
Phone records with matching identity information give criminals many ways to attack. Fraudsters can impersonate their victims more easily if they have their names, national ID numbers, and phone numbers.
Having phone records significantly increases the likelihood of a successful SIM swap attack against the victim. After criminals use a person’s identity for illegal purposes, the victim often spends months or years trying to restore their reputation.
If the scammer is able to control the phone number, they can then intercept the one-time password associated with that phone number and use that information to access the bank account, email account, and social media account of the actual account holder.
As a result of the increased risk that SIM swap attacks pose, this type of fraud is becoming increasingly prevalent in Southeast Asia, where many people rely on SMS authentication for their banking and other financial services.
Additionally, phishing campaigns will become much more effective once the attacker has access to accurate, personal information. A scammer with an accurate name and ID number will be able to create a message for the victim that looks more credible than it would have if the scammer did not have any personal details.
For instance, an attacker can fake a banking institution, a government service provider, or a telecommunications company in an effort to trick a victim into providing them with additional, more detailed information.
Criminals also pose the risk of committing identity theft, because once they have obtained someone’s national ID number and their address, they will be able to try to open up new accounts or access previously existing ones using that person’s identification.
Criminals would be able to obtain credit cards, loans, or government assistance with that person’s identification. After criminals use someone’s identity for illegal purposes, the victim may spend months or even years trying to clear their name.
Thailand has Faced Previous Data Leaks
Thai citizens’ data has previously appeared on dark web markets due to hacks that resulted in exposure of public databases from both the government and the private sector for many years. The country’s rapidly growing digital economy creates new opportunities for cybercriminals to exploit weaknesses in online systems.
The Personal Data Protection Act of Thailand requires companies to secure their customers’ personal information. Businesses that fail to comply can face penalties, but enforcement is inconsistent, and data breaches continue despite the law.
The telecom sector is a frequent target for cybercriminals. Phone companies hold vast amounts of personal information. Their systems often contain customer records spanning millions of people. A single breach can expose data on a massive scale; in 2022, a major Thai telecom provider was breached, exposing millions of customers’ personal information.
The problem is global, in the United States, researchers have warned about a threat actor claiming the sale of 72 million T-Mobile and Sprint customer records, underscoring the scale of telecom data exposure worldwide.
Security researchers also note that, as a result of reselling of many data breaches from the past multiple times, it is not uncommon for large datasets to appear on underground markets as newly breached after repackaging.
Buyers of online records from underground sources often don’t realize they are purchasing the same data from multiple sellers. This makes it impossible for investigators to trace the original source of leaked information.
What Affected Individuals Should Do
Anyone who thinks their information may be in this leak should take some measures to protect themselves. Phone companies often offer extra security measures, such as PIN codes or password protection on accounts. Enabling these options makes SIM-swap attacks harder to pull off. Customers should contact their mobile provider to set up additional verification requirements.
People should also watch for unusual activity on their accounts. Unrecognized messages, unexpected password reset requests, or sudden loss of phone service could indicate an attack. Reporting suspicious activity quickly limits the damage. Many telecom companies have fraud departments that can investigate unusual account changes.
Using strong, unique passwords for each online account reduces the risk of credential stuffing. Attackers often reuse stolen data across services, but unique passwords prevent them from accessing multiple accounts with the same credentials. Password managers can help generate and store complex passwords for every service.
Monitoring bank and credit account statements for suspicious activity can help detect identity theft early and prevent serious damage. Identity thieves often start with small transactions to test whether the stolen identity works. Report suspicious transactions to your bank or credit card provider immediately to help prevent major financial losses.
The seller on the dark web did not specify the data source or when the breach occurred. Security experts have advised people to proceed with caution until independent verification shows that this information is legitimate. Researchers will continue investigations and update the public when new corroborating evidence confirms that there is indeed a real breach.
