The case of the “9Near” hacker continues to make the news in Thailand.
The story began last month when someone offered to sell data on 55 million Thai citizens on BreachForums. Days later, and before there was any evidence of any sale, BreachForums was taken offline after police arrested the forum’s owner, “Pompompurin.”
Not to be deterred, the hacker posted information on a website, claiming that if the agency responsible for the data didn’t come forward, they would leak everything.
Days later, their messaging on the website changed. They claimed that the project had been stopped because of some conflict with an unnamed sponsor.
Stopped, but they still threatened that they would leak the data via a script “every 7 days for 10 years” if one was caught.
It was all very confusing and when the deadline came and went, there was no data leak. Then again, there was no site at that point, as the government had it blocked.
And all the while, the government was claiming that they did not know where the data came from.
This past week, however, things started heating up. The government announced that they knew who the hacker was and that he is a master sergeant second class in the army. He has been named by some news sites there. Following proper procedures, the government reached out to the suspect’s commander to have the commander bring the master sergeant in for questioning.
But at the same time that the government was still denying knowledge of the source of the data, the police announced that the source was the Mor Prom application that was used for vaccination services during the pandemic but whose function was subsequently expanded. The program is under the Public Health Ministry.
Things took yet another twist in this story when we learned that the commander couldn’t seem to get in touch with the master sergeant, who is a truck driver. So on Saturday, national police chief Pol Gen Damrongsak Kittiprapas ordered the Cyber Crime Investigation Bureau to work with the army supervisor and judge advocate to bring him in for questioning. But we also learn that it was the sergeant’s wife, a nurse, who had access to the data. A summons was reportedly issued for her to come in to be questioned, but some Thai news sources report that she is now reportedly on the run with her husband. It is not clear exactly what her role was — whether she gave her husband login credentials or did something else. But to recap:
Neither the master sergeant nor his wife may have made any money out of all this, they both may be on the run, one arrest warrant may have been issued and one summons for the wife, and if and when they are caught, they may both face prison sentences for a number of charges.
And the data on the 55 million Thai citizens? Well, if you believe “9Near,” it may still be leaked, but whether 9Near or anyone else still has access to it is …. also unclear.
Update April 11: Royal Thai Army suspends AWOL sergeant major turned cyberpunk after hacking 55 million Thais’ personal data