The National Telecom Public Company Limited data breach has emerged as one of the most significant telecommunications security failures in Thailand this year. A threat actor on a dark web marketplace claims to have compromised internal systems belonging to National Telecom Public Company Limited, also known as NT, Thailand’s state owned telecommunications provider. The actor is allegedly selling a dataset containing more than 1.19 million customer records, complete with detailed personal information, connection data, service usage logs, installation history, and technical network metadata. The listing appeared on November 21, 2025, with a reported price of three hundred dollars.
National Telecom Public Company Limited was established in 2021 following the merger of CAT Telecom and TOT Public Company Limited. As a government owned entity, NT controls a significant portion of Thailand’s telecommunications infrastructure, including fixed line telephone systems, mobile services, international gateways, submarine cable networks, cloud infrastructure, and enterprise connectivity services. Because of its central role in public and private sector communications, a breach of this magnitude raises immediate concerns for national security, customer safety, and the integrity of critical Thai communications infrastructure.
Background of the National Telecom Public Company Limited Data Breach
NT manages some of the most sensitive datasets in the Thai telecommunications ecosystem. Its databases store customer identity details, mobile subscriber information, enterprise account data, connection logs, device identifiers, and detailed service configurations. Any unauthorized access to these datasets can expose both individuals and organizations to significant risk, including stalking, targeted cyberattacks, SIM swapping, identity theft, fraud, phishing, and geopolitical intelligence exploitation.
The threat actor claims to possess exactly 1,197,636 lines of data extracted from NT systems. A sample included in the listing shows a combination of customer information, location coordinates, hardware identifiers, and proprietary installation data. The actor asserts that the data comes from internal operational systems responsible for managing connections, service deployments, ticketing, and customer technical support workflows.
The alleged dataset includes the following categories:
- Customer personal information: Full names, usernames, physical addresses, and mobile phone numbers associated with service accounts.
- Telecommunications service data: Tariff plans, service packages, offer IDs, bill cycle information, internet speed tiers, and usage details.
- Geolocation data: GPS coordinates of customer installations, often tied to latitude and longitude, which can reveal household locations and physical service points.
- Hardware identifiers: Details such as Optical Line Terminal IP addresses, device serial numbers, router models, connection medium, signal strength information, and equipment placement data.
- Installation and maintenance records: Circuit IDs, installation costs, technician notes, troubleshooting logs, and repair histories.
- Infrastructure configuration data: Information on network segments, wired connection distances, fiber routes, and links between customer premises and NT’s infrastructure.
This type of information is rarely exposed publicly because it reveals the inner architecture of a service provider’s physical and digital network. If legitimate, the dataset indicates a breach of NT’s internal customer management or provisioning systems.
Scope and Severity of the National Telecom Public Company Limited Data Breach
The National Telecom Public Company Limited data breach presents significant and far reaching consequences. Because NT is a state owned entity, its networks support government agencies, defense sectors, public institutions, educational facilities, and millions of citizens across Thailand. Many large organizations rely on NT’s backbone infrastructure for mission critical operations and secure communications.
The exposed data could be used for:
- Identity theft: Attackers may use personal details to impersonate victims, apply for financial services, or launch social engineering campaigns.
- Targeted cyberattacks: Access to service logs and device information allows adversaries to craft precise attacks against specific individuals or organizations.
- Physical tracking: GPS coordinates tied to customer installations can reveal exact home or business locations and potentially compromise personal safety.
- Exploitation of network devices: Hardware identifiers and OLT IP addresses can enable attackers to probe NT’s infrastructure for vulnerabilities.
- SIM swapping and account takeovers: Mobile phone numbers linked to identity data provide an entry point for account hijacking attempts.
- Corporate espionage: Enterprise customers may face increased risk if internal service routes or infrastructure details are exposed.
The presence of detailed technical metadata, including distance to infrastructure nodes and circuit layout information, could help skilled attackers map portions of Thailand’s telecommunications topology. In the wrong hands, this level of visibility can aid in advanced persistent attacks, targeted outages, and long term infiltration of communications systems.
How DEVMAN 2.0 Operates
DEVMAN 2.0 is an emerging ransomware collective known for exploiting weakly secured service management portals, cloud administrative panels, and exposed backend systems. The group often avoids attention by selling stolen data rather than publicly releasing it. Their attacks frequently involve credential harvesting, misconfigured VPN gateways, unpatched network appliances, and brute force attempts against administrative interfaces.
Based on the listing structure and metadata, the incident fits DEVMAN 2.0’s known operational pattern:
- Infiltration through a vulnerable web application or administrative panel.
- Unauthorized access to customer management systems or network provisioning tools.
- Exfiltration of large datasets using low profile automated scripts.
- Offering stolen records for a relatively low price to encourage fast sales.
- Retention of infrastructure information as leverage for further attacks.
The low price of three hundred dollars suggests the actor intends to sell the data quickly rather than engage in negotiation or extortion. This increases the likelihood that multiple buyers, including criminal organizations or foreign threat actors, may gain access to the information.
Regulatory and Legal Implications
As a government owned telecommunications provider, NT is subject to stringent security obligations under Thai national regulations. Exposure of personally identifiable information may trigger mandatory notifications under the Personal Data Protection Act. NT may also be required to notify government agencies, enterprises, and affected individuals whose information appears in the dataset.
Telecommunications providers hold a special responsibility due to their role in maintaining national infrastructure. Breaches that expose network architecture details can lead to increased scrutiny from regulators, partnerships with cybersecurity agencies, and internal audits of security posture.
Failure to protect customer data can also lead to:
- Legal claims from affected individuals
- Government inquiries
- Loss of trust among enterprise customers
- Damage to Thailand’s strategic communications landscape
Mitigation Steps and Recommendations
For NT and Government Telecommunications Authorities
- Conduct a comprehensive forensic audit of customer management systems, provisioning tools, and internal network access controls.
- Immediately revoke outdated credentials and enforce strict password rotation policies.
- Implement multi factor authentication across all internal and external administrative interfaces.
- Segment internal data repositories to minimize lateral movement in future attacks.
- Deploy real time monitoring solutions to detect unauthorized access or unusual data transfer patterns.
- Notify all affected customers and issue guidance on securing their accounts and devices.
- Collaborate with law enforcement and national cybersecurity agencies to investigate the source of the breach.
For Affected Individuals
- Monitor mobile accounts and billing statements for unauthorized activity.
- Be alert for phishing attempts using personal or technical details revealed in the breach.
- Install reputable device security software such as Malwarebytes to detect potential threats.
- Consider changing passwords for any accounts associated with NT services.
- Verify the authenticity of communications claiming to originate from NT.
For Enterprises Using NT Services
- Review internal security protocols for telecom integrated systems.
- Identify any exposed employee information and take precautionary steps.
- Request additional clarification and documentation from NT regarding the scope of the incident.
- Enhance firewall policies to block unauthorized attempts to access network devices.
- Conduct internal threat hunts for signs of malicious activity linked to exposed device metadata.
Long Term Impact of the National Telecom Public Company Limited Data Breach
The National Telecom Public Company Limited data breach highlights serious concerns about the security posture of telecommunications providers in the region. Because NT plays a critical role in Thailand’s communications infrastructure, any compromise has ripple effects across government sectors, businesses, and the general public. The breach demonstrates how internal technical data, when exposed, can assist attackers in understanding and potentially exploiting core systems.
The long term consequences may include increased regulatory pressure, enhanced security auditing requirements, and long term reputational damage. Telecommunications companies around the world are increasingly becoming targets for cybercriminals due to the depth and value of the data they hold. The NT incident reinforces the need for continuous modernization of cybersecurity frameworks and expanded protections for national communications infrastructure.
For ongoing reporting on major data breaches and global cybersecurity incidents, Botcrawl provides continuous analysis and updates on emerging threats.
