The website for Thailand’s Ministry of Labor has been restored after hackers defaced the site and allegedly stole government data. The ministry briefly shut down the site, deleted the words written by the hackers and returned it to its original state. The Devman hacking group claimed responsibility for the attack, stating they stole 300 GB of data and demanded a $15 million ransom. The stolen data allegedly includes citizen data, information on foreign visitors, and supposed classified documents.
Source: https://therecord.media/thai-officials-restore-labor-website-after-hack
TPRM report: https://scoringcyber.rankiteo.com/company/ministry-of-labor
"id": "min605071825",
"linkid": "ministry-of-labor",
"type": "Ransomware",
"date": "7/2025",
"severity": "100",
"impact": "",
"explanation": "Attack threatening the organization’s existence"{'affected_entities': [{'industry': 'Public Administration',
'location': 'Thailand',
'name': 'Ministry of Labor, Thailand',
'type': 'Government'}],
'attack_vector': 'Website Defacement, Ransomware',
'data_breach': {'data_exfiltration': True,
'personally_identifiable_information': True,
'type_of_data_compromised': ['Citizen data',
'Information on foreign visitors',
'Classified documents']},
'date_publicly_disclosed': '2023-10-05',
'description': 'The website for Thailand’s Ministry of Labor was defaced and '
'allegedly had government data stolen by hackers.',
'impact': {'data_compromised': ['Citizen data',
'Information on foreign visitors',
'Classified documents'],
'systems_affected': ['2,000 laptops', 'Dozen of servers']},
'initial_access_broker': {'entry_point': 'Website',
'reconnaissance_period': '43 days'},
'investigation_status': 'Ongoing',
'motivation': 'Financial, Data Theft',
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransom_demanded': '$15 million',
'ransomware_strain': 'DragonForce malware family'},
'response': {'containment_measures': ['Shut down the site',
"Deleted hacker's words",
'Changed passwords'],
'law_enforcement_notified': True,
'remediation_measures': ['Replaced affected files with backups']},
'threat_actor': 'Devman Hacking Group',
'title': 'Thailand’s Ministry of Labor Website Defacement and Data Breach',
'type': 'Data Breach, Ransomware, Website Defacement'}