Thailand's SisaCloud Hacked: Personal Data of Students and Staff Leaked

SisaCloud is a Thailand-based provider of advanced school information systems, known for managing and securing educational data for various institutions across the country. Their platform is designed to streamline administrative tasks, enhance communication between stakeholders, and improve overall efficiency in educational environments.

Breach Details

• Date of Breach: July 2024
• Discovered By: Satanic
• Announcement Date: August 4, 2024
• Data Leaked: Over 5 million lines of sensitive information
• Compromised Information:
  • User active status
  • Sisa code
  • Student ID
  • Executive reports
  • Email addresses
  • Phone numbers
  • ID card numbers
  • Full names
  • Various other personal and institutional details

Threat Actor Profile

The threat actor "Satanic" involved in the SisaCloud data breach appears to be linked to a group or individual active on BreachForums, a notorious platform for cybercriminals. BreachForums itself is the successor to RaidForums, another infamous hacking forum that was taken down by U.S. law enforcement in early 2022. BreachForums was established shortly after, continuing the operations of selling and trading hacked or stolen data until it was seized by the FBI and DOJ in March 2023​ (SiliconANGLE)​​ (Justice)​.

Regarding the "Satanic" account, additional details can be gleaned from the forum profile visible in the image:

• Username: Satanic
• Title: The Satanic Cloud
• Role: GOD (likely a high-ranking or influential member)
• Posts: 476
• Threads: 353
• Joined: September 2023
• Reputation: 742

The profile of "Satanic" suggests significant activity and influence within the forum community, reflected by the number of posts, threads started, and the reputation score. This activity level implies a well-established presence, potentially making them a key player in multiple breaches.

For more insights into BreachForums and its members, further examination of the data seized by law enforcement could reveal connections and operations that "Satanic" and similar users engaged in​ (Malwarebytes)​​ (SiliconANGLE)​​ (Justice)​.