Siripong revealed that three suspicious IP addresses from three sources were found in the Ministry of Transport data breach. He said temporary account suspensions have been ordered along with password resets. He urged the public not to worry and emphasized that the data cannot be used for transactions. Coordination with cyber police is already underway to investigate.
On 5 Aug 2026 GMT+7, Siripong Angkasakulkit, Deputy Minister of Transport, addressed the data leak involving the Department of Land Transport. He said suspicious IPs from three accounts were detected using data irregularly with abnormal search behavior. The Ministry of Transport has notified the cyber police to proceed with the investigation. The suspicious IPs originated from three sources: Bangkok Noi district municipal officers, the Expressway Authority of Thailand, and the Singhanat Task Force. Accounts from these three agencies have been temporarily suspended. Agencies accessing Ministry and Department data have been instructed to reset passwords to clear leaked data, as it remains unclear if the accounts or passwords were genuinely compromised or hacked. The full list of names has been handed to the police for action.
Siripong assured the public that although the leaked data includes personal information, it is basic data that cannot be used for any transactions. The Department of Land Transport allows various agencies to connect to facilitate public services within the Ministry of Transport. However, criminals have illicitly sold the data on the Dark Web. The ministry has blocked all regular access channels, preventing normal viewing, but those involved with the Dark Web may still access it. Efforts to prevent this continue. Therefore, the public should not worry, as this data cannot be used for ownership transfers without identity verification. He emphasized that the Ministry of Transport will not contact individuals or send any links by any means to prevent scams.
When asked about the number of people affected by the data leak, Siripong said there were multiple suspicious searches, with abnormalities seen around 6,000 to 7,000 times. Some accounts conducted about 2,000 searches each.
Asked whether there was suspicion about why individuals of importance had their data leaked, Siripong said this is part of the police investigation since the search patterns are unusual and warrant attention. The matter is now in police hands but no conclusions have been reached yet.
Regarding links to the dark market, where tokens were offered to access data, and whether the hacking aimed to sell data, Siripong said this is likely part of the case. Whether there is political involvement will depend on police conclusions.