Government agencies will consider adopting multi-factor authentication (MFA) and resetting passwords following data leaks that exposed sensitive information from at least 20 state agencies.

The Digital Economy and Society (DES) Ministry will ask the cabinet to back the move. Minister Chaichanok Chidchob said agencies should change their system passwords to prevent access using compromised credentials.

Agencies would also be required to comply strictly with the Personal Data Protection Act (PDPA), with those failing to implement prescribed security measures facing legal penalties.

The ministry will seek international cooperation to crack down on dark-web marketplaces selling stolen login credentials, which Mr Chaichanok described as transnational crime.

He said the latest leaks were caused not by direct cyberattacks but by criminals buying previously stolen usernames and passwords from dark-web marketplaces.

Thailand has accumulated a huge volume of leaked credentials, with an estimated 60 million additional accounts compromised in the latest year alone.

Criminals can use valid credentials to access government systems through application programming interfaces (APIs) and extract data without breaching underlying cybersecurity infrastructure. MFA is needed to strengthen authentication, he said.

Regarding leaked personal information belonging to himself and other ministers, Mr Chaichanok said the Bhumjaithai Party's (BJT) legal team would file a police complaint. Cybercrime investigators have obtained log files and IP addresses and seized servers.

Police have also identified the telephone number used by the first person to post and distribute the leaked information. Further action against people who later shared the data will depend on whether those affected wish to file complaints.

The incident follows warnings from Thanarat Kuawattanaphan, CEO of Dome Cloud, who said leaked information had been identified from 19 ministries and the Prime Minister's Office, covering 20 government agencies.

Mr Thanarat said more than 500,000 Thai citizens' records had been found among the leaked data, including national ID numbers, household registration details, family relationships, vehicle registration records and facial photographs.

Some data were more than five years old, raising concerns about whether state agencies were retaining more personal information than necessary.