Huge patient data leak from Siriraj Hospital
ABOUT 39 MILLION PURPORTED patient records from Siriraj Hospital have been offered for sale on an internet database-sharing forum in what appears to be the latest hack of the country’s public health sector.
Authorities are investigating the post, which was on raidforums.com. The leak is said to include records of VIP patients.
There was no clear indication whether the person who offered to sell 38.9mn patient records last Sunday (Jan 9) really had such a huge trove of data.
However, the poster said a sample file was available and contact could be made through a Telegram app account. The price for the data was negotiable and it would go to only one buyer, the poster added.
The data supposedly comprises names, addresses, Thai IDs, phone numbers, gender details, dates of birth and other information, according to the poster, who used the name “WraithMax”.
“There was a large data leak concerning Siriraj’s patient records that has been offered for sale,” said Dr Sutee Tuvirat, an information systems security professional.
The data is not only from Siriraj Hospital but also from nearby Siriraj Piyamaharajkarun Hospital, which has records of VIP patients, he said.
Most local hospitals still had no cybersecurity teams or chief information security officers who could monitor threats.
“Even some department stores which invested in cybersecurity have been hacked, but hospitals which keep a great deal of sensitive data still do not make investment in this area a priority,” Dr Sutee said.
“Healthcare is one of the targeted sectors as it contains a lot of sensitive information.
“Victims may not even know their data has been misused. Once data is breached, hackers will steal all the data. They work professionally, making money and gaining creditability.”
The acting deputy secretary-general of the National Cyber Security Agency, Grp Capt Amorn Chomchoey, said he was aware of the Siriraj case and was investigating it.