Another data breach: Info leaked on Bangkok Immigration website
In the second data breach this week involving a Thai government website for foreign residents, the Bangkok Immigration site leaked personal details, such as passport numbers and visa information, of expats who registered for an appointment.
Expat and local blogger on Thai news, Richard Barrow, posted screenshots of the data breach, with personal details redacted, saying the website is exposing sensitive personal data.
URGENT WARNING: Are you using the online form to book an appointment at Bangkok Immigration? You should be aware of a data breach that exposes all of your personal data such as passport number, nationality, date of birth, email, telephone number, visa expiry date etc.
The Immigration data breach is NOT a hack. All you have to do is change certain characters in the URL of your completed booking form to see data for other people. I am sure a high school student could write a simple script to mine all of this data going back years.
On Monday, the vaccine registration website for foreign residents, run by the Department of Disease Control, exposed the personal information of those who had registered for an injection.
When registering for a vaccine on Thailandintervac.com, other people’s names, passport numbers and locations would appear on the page to input “user information.” Some say that when the page was refreshed, another name and personal details would appear. Multiple expats complained that they would see and edit the information of other people registering.
The Thai government released a statement after the first data breach, apologising for the incident and saying there was a “temporary glitch” while the website was undergoing “urgent system maintenance” to keep up with the high demand after Thailand opened up vaccine registration to expats.
