Lessons from Europe's cyberattacks highlight the risk of hackers breaching Thailand's systems. Dr. Rueabin recommends upgrading personnel skills to plug leaks and improve detection systems, noting that AI enables hackers to work ten times faster.
Following recent cyber threats faced by several European countries, a new wave of cyberattacks occurred, on 2 Nov 2020, when hackers breached the cooling and freezing systems of supermarkets in at least seven countries: Sweden, Belgium, Luxembourg, Finland, Ireland, Estonia, and France, adjusting temperatures from below freezing to between 18 and 50 degrees Celsius. Similarly, on 4 Nov 2020, hackers attacked the French National Blood Institute (EFS), infiltrating the system to raise temperatures. The attacks caused damage to dozens of supermarkets and local fresh food stores, resulting in massive food spoilage and disposal. A local butcher in Belgium estimated his losses at 15,000 euros (around 500,000 baht). Meanwhile, the French National Blood Institute detected anomalies and quickly restored their system, avoiding any loss of blood donations. Authorities are investigating both incidents, with no confirmed identification or motives of the perpetrators. Although Russian hacker groups NoName057 and Z-Pentest Alliance claimed responsibility for breaching supermarket control systems, experts doubt these claims, as the attack patterns do not match these groups' usual methods.
At the same time, some analysts suggest the hackers may be state-sponsored, as the attacks align with "hybrid warfare" tactics—sabotage operations by the Russian government to destabilize Europe since the Ukraine war began. Alternatively, some think the attacks could be the work of independent hackers or youth groups intending to cause disruption.
Regarding motives, most analysts agree this was not ransomware extortion, as no ransom demands were made and the immediate food spoilage rendered negotiation impossible.
Tom Hegel of cybersecurity firm SentinelOne noted that the absence of financial demands indicates sabotage motives. This aligns with European Commissioner for Agriculture Kristof Hansen and the EU's statement that the incidents aimed to disrupt food supply chains, undermine consumer confidence, and cause psychological fear among the public. European supermarket cooling systems are often remotely managed via internet-connected IoT devices, some linked through 4G mobile networks, allowing easy monitoring and reducing staff visits. However, this connectivity also creates vulnerabilities hackers can exploit without sophisticated malware or digital weapons. Cyber threats in the AI era will continue to intensify.
Thairath Online spoke with
Dr. Thamthee Sukchotirat, known as “Dr. Rueabin,” a data scientist and technology expert, who said that the recent European cyberattacks causing product damage highlight that the French National Blood Institute’s system was effective in detecting threats before damage occurred.
However, with advancing technologies, especially artificial intelligence (AI), hackers have more methods to infiltrate systems. Developing programs or software now requires fewer people and is much faster. Based on his experience and industry consultations, Dr. Thamthee estimates this speed has increased about tenfold.
For example, the recent high-profile hack of Binance, the world's largest cryptocurrency exchange, which resulted in theft of crypto assets worth over 6.34 billion USD (around 200 billion baht), involved money laundering paths never seen before. Achieving this requires new scenario capabilities and AI, indicating future hacks will reach new levels. Dr. Thamthee points out that common gaps often stem from "insiders"
or "vendors," who may unintentionally or intentionally cause vulnerabilities, such as clicking malicious links.
"Insiders or vendors already have authorized access to internal data. If hackers access their devices, they can operate like insiders. This is a vulnerability. The challenge is how hackers gain access, often through careless clicking or installing software, as personal and work lives can sometimes mix, causing errors." How should Thailand elevate its cyber threat response? Dr. Thamthee discussed common cyber threats Thailand faces, such as data breaches for resale,
including health data from hospital information systems (HIS), where millions of patient medical records have been stolen and leaked or sold on the dark web, representing highly sensitive data with severe damage potential. Although this is not direct theft from system owners, criminals and scammers buy such data to defraud victims. Comparing to the recent French National Blood Institute case, it is clear that Thailand’s detection (Monitoring) systems require significant improvement, as France detected threats before damage, whereas Thailand still suffers data leaks. Based on these lessons, Dr. Thamthee recommends enhancing prevention and response as follows:
1. Government agencies and private providers involved must upgrade capabilities to keep pace with AI advancements and rising cyber risks, particularly by upskilling personnel to plug vulnerabilities and reduce errors. 2. Develop detection (Monitoring) systems so that if an intrusion bypasses initial defenses, it can still be detected early and mitigated. Alerts should be tiered by severity (e.g., green, yellow, red), with prompt investigation starting at yellow alerts to allow timely responses. Also, prioritize who must be notified to prevent unnecessary panic.
3.
Consumer Council urges government to regulate standards and beware of cyber threats across all industries. Mr. Udomthip Praikaset, Deputy Committee Member for Communications, Telecommunications, and Information Technology of the Consumer Council, said cyberattack risks are growing more complex alongside technological advances, especially AI, which can analyze systems and find security gaps faster, but can also be exploited by malicious actors to enhance attacks.
Effective risk management requires accepting that no system is 100% secure. Organizations should not only focus on preventing attacks but also on detecting anomalies, limiting damage, and rapidly restoring services.
Regulators must seriously prioritize cybersecurity, particularly for businesses serving large populations or linked to critical national infrastructure. In Thailand, the National Cybersecurity Committee (NCSC) and relevant industry regulators should coordinate to set appropriate security standards based on each sector's risk level, including finance, telecommunications, retail, and public safety services. Additionally, operators should regularly assess system vulnerabilities, restrict external access to control systems, maintain backup systems and business continuity plans, and isolate compromised systems to prevent damage spread.
The public must protect themselves but avoid panic. Mr. Udomthip emphasized that cyberattack risks exist in every country, as businesses and citizens increasingly rely on digital systems, especially financial, payment, and communication services, which have become daily essentials. If banking or electronic payment systems fail due to cyberattacks, making withdrawals or transfers impossible, people should keep an appropriate amount of cash as a backup. Similarly, with many people now using app-based calling instead of traditional phones, disruptions to these apps or internet could hinder urgent communication. There are also risks from smart home devices or Internet of Things (IoT) gadgets like security cameras, robot vacuums, and internet-connected appliances, which may send data to cloud servers or service providers abroad. While these devices enhance convenience, consumers should be aware that stored or transmitted data may include home images, lifestyle habits, or personal usage information. Unauthorized access could threaten privacy and security. Therefore, users should choose devices from manufacturers with clear security policies, change default passwords, regularly update software, and review app permissions linked to devices.
"Although some cyberattacks may not directly involve personal data, data breaches remain a serious risk as leaked information can be used for fraud or identity theft. People should prioritize protecting their data, especially email accounts, which often provide access to other digital services. Enabling two-factor authentication (2FA), using strong unique passwords, and avoiding suspicious links or files are crucial," Udomthip said. However, the public need not panic or hoard cash and goods excessively but should prepare appropriately based on their risk level, similar to preparations for floods, power outages, or other emergencies that temporarily disrupt essential services. Sources:
Consumer Council, The Guardian, Reuters
