Thailand's Ministry of Digital Economy and Society is preparing to ask the Cabinet to mandate multi-factor authentication on key state systems after identifying 221 million exposed login records linked to the country, according to The Nation, which cited Digital Economy and Society Minister Chaichanok Chidchob. Short-term measures were due before the Cabinet on August 11, 2026, alongside a broader overhaul of national data-security systems. The 221 million figure comes from a single outlet's account of the ministry's assessment and has not been corroborated in the other sources reviewed here; no independent breakdown of which systems, breaches, or years the records span has been published. It lands in the middle of a bad quarter for Thai institutions: a credential-harvesting flaw at the Stock Exchange of Thailand's securities depository exposed roughly 200,000 investors in late July, and researchers documented an AI-agent-driven intrusion campaign aimed at the Ministry of Finance earlier the same month.
What Happened
Three distinct threads run through the reporting, and they should not be conflated.
First, the national picture. The Nation reports that the Digital Ministry compiled data on the "structure, sources and system vulnerabilities" associated with leaked Thai data, arriving at 221 million exposed login records tied to the country. That is roughly three times Thailand's population, which is consistent with aggregated credential dumps spanning many services and many years rather than a single fresh breach. The ministry's response is regulatory: mandatory MFA on key state systems, plus a longer-term restructuring effort. No source in this set describes an attacker, an intrusion, or a single event behind the 221 million number.
Second, Thailand Securities Depository (TSD), a subsidiary of the Stock Exchange of Thailand. TSD detected abnormal access to its Investor Portal on the evening of Saturday, July 25, 2026, and confirmed unauthorised access to personal data the following morning. It blocked the affected system, notified brokers, custodian banks and regulators, and filed a report with the Technology Crime Suppression Division (TCSD) on July 27. The Securities and Exchange Commission's deputy secretary-general and spokesman Anek Yooyuen said the SEC received TSD's preliminary incident report on July 26 and is monitoring the company's remediation.
Third, the Ministry of Finance. Threat intelligence firm Hunt.io and researcher Bob Diachenko found three simultaneously exposed attacker directories on a Hong Kong-hosted server between July 9 and July 13, 2026, containing artifacts from an apparent espionage operation against the ministry. Hunt.io published its findings on July 23. Critically, the Ministry of Finance has not confirmed a breach, and BleepingComputer notes that some recovered artifacts show only that systems were targeted, not successfully compromised. Dark Reading reports the Thai government has not commented publicly, though Hunt.io and Diachenko notified ThaiCERT and the National Cyber Security Agency (NCSA) on July 15 and received same-day acknowledgement.
What Was Taken
For the 221 million records, the sourcing supports only the label "login records." Nothing in the available reporting describes the format, whether passwords were plaintext or hashed, or how much of the set is recycled from prior public dumps. Treat the number as a ministry-level exposure estimate, not a confirmed victim count.
The TSD exposure is far better documented. Bangkok Post and Thairath both put the affected population at approximately 200,000 investors. Bangkok Post adds useful denominator context: that is around 4% of the roughly 5 million shareholder records in the system. The exposed fields, per both outlets, include full names, dates of birth, national identification numbers, home addresses, phone numbers, email addresses, brokerage firm names, securities account numbers and bank details.
The bank data is where accounts differ. Bangkok Post describes "partial bank account details," while Thairath reports that a deeper joint investigation on July 27 revealed full "bank account numbers" were also leaked, prompting a second round of email and SMS alerts to affected parties. The Thairath account is the later of the two and reflects the expanded findings, but the discrepancy is unresolved in the public record and readers should assume the worse case when modelling fraud risk.
TSD is consistent across all four of its sources on what was not taken: no securities holdings, portfolio values, transaction histories, or assets in custody were affected, and Bangkok Post reports the investigation found no evidence that usernames or passwords were compromised. TSD executives stated no financial losses were detected. Trading and settlement operations continued normally throughout.
For the Ministry of Finance, Hunt.io recovered 585 files totalling roughly 470 MB from the attacker infrastructure, including exploit code for multiple CVEs, web shells, suo5 HTTP tunnelling tools, custom scripts, compiled payloads, stolen credentials and Hermes AI agent session logs. The files referenced ministry systems by name, hostname and internal IP. What the attackers actually exfiltrated from the ministry is unknown, and the initial access vector was never determined.
Why It Matters
A government reaching for an MFA mandate after tallying 221 million exposed credentials is an admission that password-only authentication has already failed at national scale. When the exposed credential pool exceeds the population by a factor of three, credential stuffing stops being a probabilistic attack and becomes a lookup. Every Thai-facing service that still accepts a username and password alone should assume its user base is already enumerated.
The TSD incident is the more instructive technical story, because it required no credential theft at all. As Bangkok Post reported, TSD managing director Pichaya Chomchaiya said the incident was not a breach of backend infrastructure. A legitimate, authenticated user manipulated their own user ID on the Investor Portal's User Profile page; insufficient server-side validation caused the application to return other users' profiles, and repeated ID iteration produced a bulk harvest. This is a textbook insecure direct object reference, and it defeats the exact control the Digital Ministry is now mandating. MFA gates the front door; it does nothing about an authorised session walking sideways through an authorisation gap. Organisations rolling out MFA in response to this news should be clear-eyed that it would not have stopped the country's most visible recent data leak.
The Hermes case matters for a different reason. Dark Reading frames it as the latest instance of attackers offloading substantial operational work onto large language models, citing a parallel case documented by Sygnia in which a lone operator used AI to orchestrate an extortion campaign against a large AWS customer environment. An agent running unattended compresses the time between initial access and lateral movement to something no human-paced detection workflow was designed for.
The downstream risk is social engineering. Thairath reports that Thai cyber police warned the larger threat is not the leak itself but scammers using the stolen identity data to impersonate officials. TSD's own advisory told users to distrust unsolicited emails, SMS and phone calls and never to hand over passwords or personal information to unverified callers. With national ID numbers, addresses and bank details in circulation, impersonation calls become extremely convincing.
The Attack Technique
TSD: an IDOR in the Investor Portal's User Profile page. The attacker authenticated legitimately, then altered the user ID parameter. The application failed to verify that the requesting session was authorised to read the requested record and returned another investor's profile. Iterating the identifier scraped data at volume. Thairath reports the incident involved a single perpetrator and that the vulnerability has since been closed. TSD blocked suspicious sources and accounts, disabled affected system connections and increased monitoring, per the SEC.
Ministry of Finance: Hunt.io attributed much of the post-exploitation orchestration to the open-source Hermes AI agent running in unrestricted "YOLO" mode, which lets the agent act without human approval at each step. The recovered scripts targeted the ministry's Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console and an administrative web panel. Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords, which is credential-reuse testing against a government mail tier and connects directly back to the exposed-credential problem the Digital Ministry is now legislating against. Hunt.io says it found a PHP web shell deployed on a Ministry of Finance web server and that session files and logs indicate access to multiple internal systems. The Record notes the researchers found the infrastructure while the intrusion was still in progress. Initial access remains undetermined, and the ministry has not confirmed compromise.
For the 221 million records, no technique is described in any source. Assume aggregation from multiple prior incidents until the ministry publishes otherwise.
What Organizations Should Do
- Deploy phishing-resistant MFA, not SMS. If you operate Thai-facing services, the credential pool is compromised. Prioritise FIDO2 or passkeys on administrative and internet-facing accounts. SMS one-time codes are weak against the SIM-swap and vishing activity Thai cyber police are already warning about.
- Audit every object-reference endpoint for server-side authorisation. The TSD flaw was not exotic. For each API route that accepts a user ID, account number or document ID, verify the server independently confirms the session owns the requested record. Do not rely on the client sending its own identifier. Test by authenticating as one user and requesting another's resources.
- Alert on enumeration patterns, not just failed logins. TSD's attacker was authenticated and every request looked valid. Build detections for a single session retrieving abnormally many distinct records, and for sequential or rapidly varying ID parameters against profile and account endpoints.
- Hunt for AI-agent tradecraft in your telemetry. Agent-driven post-exploitation produces high-velocity, broad-surface activity. Look for rapid sequential probing across unrelated internal services, off-hours tool execution and web shells on administrative consoles such as Ambari, GlassFish and Hadoop management interfaces.
- Kill credential reuse on mail and admin tiers. The Hermes scripts tested hardcoded credentials against ministry mail servers. Force resets on any account whose password appears in exposure feeds, block reuse against known-breached password lists, and disable legacy authentication protocols that bypass MFA.
- Prepare for the impersonation wave before it arrives. Where national ID numbers and bank details have leaked, out-of-band identity verification for customer service and payment changes stops being optional. Warn customers proactively, publish the exact channels you will and will not contact them through, and never ask for passwords or full account numbers on inbound calls.
- Fix your external notification path. Hunt.io and Diachenko reported to ThaiCERT and the NCSA on July 15, eight days before public disclosure. Make sure a researcher with a finding about your network can reach someone with authority to act within hours.
Sources: Digital Ministry seeks MFA mandate after 221m login records exposed | Hermes AI agent used to automate attack on Thai Finance Ministry | Hackers used autonomous AI agent to spy on Thailand's finance minis... | AI Agent Drives Espionage Attack on Thai Ministry of Finance | TSD blocks cyber threat after Investor Portal data leak | Bangkok Post - 'No money lost' following TSD portal leak | Bangkok Post - TSD investor data breach cue for SEC action | Summary of TSD Data Breach Incident: Confirmation of No Loss of Sha...