mof.go.th - Ministry of Finance (Thailand) Listed by Babuk2 Ransomware Group

On March 20, 2025, the Ministry of Finance of Thailand appeared on the leak site operated by the Babuk2 ransomware group. Internal files were allegedly exfiltrated during a ransomware attack on mof.go.th, and the incident has placed potentially sensitive government data into the hands of criminals who routinely publish stolen information when demands are not met.

What Public Reporting Shows

Public reporting indicates the Thai Ministry of Finance was listed on the Babuk2 leak site on March 20, 2025. The data consists of internal files exfiltrated in a ransomware attack. The number of affected individuals remains unknown, and the precise volume or sensitivity of the files has not been independently verified in open sources. The listing appeared on an onion address hosted by the group and was also tracked by ransomware.live.

Why This Matters for You and Your Family

When a national finance ministry suffers a breach, the consequences rarely stop at government servers. Tax records, financial transaction logs, citizen identification details, and vendor information can easily contain data that overlaps with ordinary citizens. If your tax filings, bank details, or government service applications were processed through systems connected to the Ministry of Finance, fragments of your information may now be circulating among criminals. For families, this risk extends beyond one person: a single exposed government ID, email address, or phone number can link parents, children, and shared household accounts.

Credential leaks like this one frequently cascade into account takeovers on personal email, banking, and social media. Once criminals control those accounts they can reset passwords elsewhere, request new government documents, or sell the access on underground forums. Children’s accounts are especially vulnerable because many families reuse credentials or linked email addresses across school portals, gaming platforms, and official services.