Thailand pushes mandatory MFA after major credential leak

Thailand is preparing to make mandatory multi-factor authentication official policy after around 60 million more credential records were leaked on the dark web.

Digital Economy and Society Minister Chaichanok Chidchob is seeking cabinet support for compulsory MFA across government systems. Prime minister and interior minister Anutin Charnvirakul has prioritized the issue, according to Chidchob, reports The Nation.

The ministry is collaborating with the National Cyber Security Agency (NCSA) and the Personal Data Protection Committee (PDPC) to boost enforcement of the Personal Data Protection Act. If suitable security safeguards are not implemented within a reasonable time, agencies could face legal action.

Thailand’s Interior Ministry says recent data leaks were caused by criminals using passwords bought on dark‑web marketplaces, rather than a direct hack, logging in through normal system APIs to extract information.

The country now has more stolen Thai login records circulating on the dark web than its entire population, according to officials, with roughly 60 million additional credentials appearing in the past year, although many are duplicates or multiple accounts belonging to the same person.

The ministry’s immediate response focuses on mass password resets and deleting dormant user accounts, which pose a significant vulnerability. Civil servants and the public are being urged to change passwords for email and other online services, while agencies will remove accounts belonging to former staff.

The clean up comes after the online circulation of personal data linked to prime minister Anutin, cabinet ministers and other senior officials, including information reportedly taken from national ID cards. Cybersecurity specialists traced the exposed material to the Department of Provincial Administration’s website, raising fears of a compromise of civil registration systems.

Preliminary checks show no evidence of a breach of the core database, and investigators have closed the access channels involved while digital forensics continues. Police have traced IP addresses and phone numbers connected to the unauthorized access, and seized a server allegedly used to cross‑check stolen data before it was offered for sale.

Authorities are working to identify suspects, and the ministry says it will pursue legal action to the fullest extent. Thailand is in the midst of advancing Digital ID 2.0 as it expands its digital trust framework and interoperability.

Article Topics

cybersecurity  |  data protection  |  multifactor authentication  |  Thailand