Although Thailand’s Personal Data Protection Act has been in force since May 2020, people’s concern about the security of their sensitive online information has hit new heights following the recent 9Near scandal.
A hacker calling himself “9Near” announced in mid-March on BreachForums, a dark web hacking platform, that he was in possession of the personal data of 55 million Thais.
Using a symbol resembling the Move Forward Party’s logo, he claimed to have names, citizen ID numbers, birthdates, addresses and phone numbers. 9Near translates as “Kao Klai”, which sounds similar to Move Forward’s name in Thai.
After the hacker’s claim failed to win much attention, in late March he began sending text messages to well-known people to prove he actually had their personal information. He also published what he claimed was a sample of the hacked personal data of Thais on the website https://9near.org/.
The hacker threatened to release all the data and name the agencies responsible unless they contacted him by April 5. “Almost election, decide wisely. We are not kidding,” read the statement, suggesting there was a political element to the blackmail.
The threat finally prompted Digital Economy and Society (DES) Minister Chaiwut Thanakamanusorn to call a press conference on March 31 in a bid to allay public concerns. He also vowed that authorities would block access to websites that released any of the personal information involved in the case and take harsh action against those responsible.
How the scandal unfolded
On April 2, 9Near appeared to backtrack on his threat. An announcement published on his website said he was sick of dirty politics and did not want to hurt anyone.
“Because their plan is so dirty, we have no reason to leak this information anymore,” his post said. The hacker insisted that he was not a scammer and had never sold personal information to anyone.
9Near claimed his sponsor was using the leak to seek political advantage – something he disagreed with. He also portrayed himself as a hacktivist who was aiming to improve society.
The following day, the DES Ministry claimed that 9Near comprised a group of Thai nationals who planned to leak personal data to reveal loopholes in Thailand’s digital security system.
Move Forward Party pushed for the government to nail the culprits quickly and insisted it was not involved in the scandal despite the similarity in names.
Cyberpolice finally arrested Sgt-Major Second Class Khemarat Boonchuay on suspicion of being 9Near. The soldier had not reported to work at the Army Transport Department since April 3. Five days later, he was suspended from duty. Khemarat surrendered on April 12, and police also pulled in his wife, a nurse, for interrogation. Paraded at a press conference, he denied hacking into any system and claimed he had bought the personal data of 8 million Thais from BreachForums for just 8,000 baht.
An investigation is ongoing. Khemarat faces up to five years behind bars if convicted of violating the Computer Crime Act or spreading false information by digital means. However, if he is found guilty of abusing personal data, the penalty is up to one year in jail and/or a maximum fine of one million baht per damaged party. In other words, if he has abused the personal data of a large group of people, the accumulated prison sentence could be huge.
Personal data matters
Personal information like name and surname, national ID card number, address and telephone number can be used to identify a person and even reset their passwords. The Electronic Transactions Development Agency (ETDA) has warned that people whose personal data is leaked are at risk of their identity or funds being stolen and may even find themselves linked to illegal activities.
The Bank of Thailand has advised people to immediately change their passwords if they suspect their personal data has been hacked.
Last year, 6,114 fraudulent transactions via mobile banking were recorded with damages worth a total of 274.39 million baht.
By Thai PBS World
