Thailand plans mandatory multi-factor authentication after massive data leak

Biometric Update reports that Thailand is moving towards making multi-factor authentication a mandatory policy following the exposure of approximately 60 million credential records on the dark web.

The Digital Economy and Society Minister is seeking cabinet approval for compulsory multi-factor authentication across all government systems. This initiative comes after a significant data leak, with around 60 million additional credentials appearing on the dark web in the past year, exceeding the country's population. The Interior Ministry attributes these leaks to criminals purchasing passwords from dark-web marketplaces and using them to log in through normal system APIs, rather than direct system breaches. In response, the ministry is implementing mass password resets and deleting dormant user accounts.

Civil servants and the public are urged to change passwords for various online services. The data leak reportedly included personal information linked to high-ranking officials and information from national ID cards, raising concerns about civil registration systems. While preliminary checks indicate no breach of the core database, authorities are pursuing legal action against those responsible and have seized a server allegedly used for cross-checking stolen data. Thailand is also advancing its Digital ID 2.0 initiative and expanding its digital trust framework.

Source: Biometric Update