Cyber Criminal: Threats to Information Steal of Thai SMEs

Cyber attacks are threatening small and medium-sized enterprises (SMEs) in Thailand. Research shows that Thai SMEs have experienced cyber attacks and have experienced operational disruptions due to these threats. The trend of attacks is becoming more and more severe, affecting both financial and corporate reputations. This can lead to irreparable damage.

Air Vice Marshal Chomchai, Secretary-General of the National Cyber Security Committee (NCSC) revealed that the Thailand Computer Emergency Response Team (ThaiCERT), stated that recent data showed that there were more than 1,827 cyber-threat attacks, 124 private-sector attacks.

Cyber attacks on small and medium-sized enterprises (SMEs) are increasingly likely to affect both financial and corporate reputation. Over 65% of SMEs were cyberattacked. Research from Cybersecurity for SMBs: Asia Pacific Business Prepare for Digital Defense by Cisco found that around 56% of businesses in Thailand have experienced operational disruptions due to cyber attacks.

Threats to both security and law

The survey also showed that 47% of the respondents who had been hit by the attacks caused business damage worth at least 16 million baht, while 28% suffered losses worth more than 32 million baht. The biggest reason why 49% of SMEs were attacked by malware was 91% followed by phishing attacks 77%.

This is because cybersecurity solutions are not effective enough to detect or prevent cyber-threat attacks, while 25% say the main reason is that organizations do not implement cybersecurity solutions and do not put security first.

At present, Thailand’s small and medium-sized businesses face two major threats that may seriously affect their businesses..

First, cybersecurity threats, including malware, viruses, ransomware, and spyware, can easily attack business systems. In addition, there are fraudulent emails or fake websites to steal personal information such as passwords, as well as DDoS attacks that send massive amounts of information to destroy systems. Hackers often target customers’ information such as names and addresses, and financial information for sales or illegal transactions.

Second, Personal Data Protection Act (PDPA) threats posed by unsafe data collection and processing. Small businesses that lack appropriate data management systems may leak personal information, which is a violation of PDPA laws and can lead to very high fines.

Both of these threats pose serious risks to businesses, both information security and corporate reliability.

Apart from Thai businesses, ASEAN businesses remain at high risk, Kaspersky, a global cybersecurity expert, said that it has blocked more than 23 million brute-force attacks in Southeast Asia in the first six months of 2024.

In the case of brute-force attacks, cybercriminals use dangerous techniques to crack computers and user accounts based on systematic speculation.

Imagine an attacker trying to open a vault with every key tested. They will use a special program that can try thousands of tens of thousands of passwords per second, from simple passwords to more complex codes..

When an attack is successful, criminals will have access to confidential personal information such as identity, credit card code, or financial information. They may also install malware to control the system or steal more information.

'Thailand' topped three countries that have been attacked by cybercriminals the most

According to statistics, from January to June 2024, Kaspersky’s enterprise products installed in companies of various sizes in Southeast Asia have detected and blocked 23,491,775 Bruteforce.Generic.RDP.

Vietnam, Indonesia, and Thailand are the top three countries with the most RDP attacks in the region, with 8.4 million attacks, 5.7 million, and 4.2 million attacks, respectively, while Singapore had 1.7 million attacks, more than 2.2 million Philippines, and less than 1 million in Malaysia attacks.

Today, cybercriminals are leveraging AI to enhance brute-force attacks by automating password creation and testing, accelerating speed and efficiency. The impact of corporate network breaches is far more serious.

Organizations may experience data breaches, or if systems are compromised, operations will be disrupted, resulting in significant financial impact as they face costs from outages, data recovery efforts, and fines from regulators.