Vehicle registration numbers, including chassis numbers, have been leaked. Four tactics used by "dark web" sites to extract personal data and search vehicle registrations are revealed. Most government agencies outsource data collection to private firms, increasing the risk of leaks. Tags: [vehicle registration, data leak, dark web, personal data, government outsourcing, cybersecurity]
On 3 Aug 2026 GMT+7, Nithikorn Boonyakulcharoen, advisor and subcommittee member on enhancing Thailand's digital competitiveness for the opposition leader's team, revealed on his personal Facebook a warning about vehicle registration data leaking publicly. He highlighted websites that allow searching personal information via vehicle registrations. After this disclosure, the issue gained widespread attention on social media, prompting government agencies to respond, while citizens raised concerns about personal data security.Tags: [data breach, vehicle registration, social media, government response, personal data security]
Thairath Online's special news team interviewed Nithikorn Boonyakulcharoen, advisor and subcommittee member on enhancing Thailand's digital competitiveness for the opposition leader's team, regarding the origin of the leaked vehicle registration data.Tags: [interview, data leak, vehicle registration, digital competitiveness]
Nithikorn disclosed that Earth Thanarat, CEO of DomeCloud, noticed vehicle registration numbers and personal data being traded on the dark market and Discord groups. Eventually, all this information was compiled into a website named WIN.DOG.Tags: [DomeCloud, data trading, dark web, Discord, WIN.DOG, personal data]
Testing by searching phone numbers, names, or vehicle registrations of acquaintances on the site revealed "complete information available." Although the website has since been shut down due to public outcry, Nithikorn preserved full screenshots as evidence.Tags: [data search, evidence, website shutdown, personal data]
The vehicle registration data discovered on the website included the following:Tags: [data discovery, vehicle information]
1. Entering a "vehicle registration number" yields the owner's name, address, ID card number, chassis number, inspection date, and tax renewal date.Tags: [vehicle registration, personal data, inspection, tax renewal]
2. Entering a "chassis number" provides detailed information about the vehicle and its owner.Tags: [chassis number, vehicle details, ownership]
3. Entering an "ID card number" reveals ownership details of all vehicles (cars and motorcycles) held by that individual.Tags: [ID card, vehicle ownership, comprehensive data]
4. Entering a "phone number" uncovers the person's full name, ID card number, and address, but does not show vehicles they own.Tags: [phone number, personal details]
If criminals already possess your ID card number and phone number, searching this database instantly reveals what vehicles you own. They can then use this precise information to impersonate finance companies or government officials over the phone, crafting believable scams. They can see how many vehicles you have, outstanding debts, whether a vehicle is still under financing, or if it's registered under a finance company’s name, enabling highly realistic fraud.Tags: [identity theft, fraud, vehicle data, scams, impersonation]
Furthermore, this is not the only website involved; numerous transactions occur on Discord, and there have been sites pulling data from the Department of Provincial Administration, including information on the Prime Minister and ministers.Tags: [data breach, Discord, government data, high-profile targets]
Regarding vehicle registration data, Nithikorn offered two key recommendations to the Department of Land Transport and the government: First, data storage—currently, government agencies outsource software and database management to private companies, granting them full access and control, meaning the government lacks true ownership or oversight. The government must reclaim data control and urgently strengthen cybersecurity. Second, response and notification—hacking or data leaks violate computer and personal data protection laws, but government agencies must "immediately" notify and warn citizens when breaches occur, enabling them to protect themselves against scams. Currently, such notification measures are lacking.Tags: [data management, outsourcing, cybersecurity, data breach notification, government policy]
Nithikorn plans to compile all screenshot evidence and data to submit to the Communications, Telecommunications, and Digital Economy and Society Committee. The aim is to invite relevant agencies, including the Personal Data Protection Committee (PDPC), to investigate and discuss how to properly notify the public.Tags: [investigation, parliamentary committee, PDPC, public notification]
Meanwhile, on 4 Aug 2026 GMT+7, Siripong Angkasakornkiat, Deputy Minister of Transport, acknowledged the issue and coordinated with the National Cybersecurity Committee (NCSC) to urgently verify the facts.Tags: [Ministry of Transport, cybersecurity, investigation, government response]