It gets worse! Thailand Intervac website taken offline after data leak

[Jonathan Fairfield]

 

Just when you thought the process for foreigners in Thailand to register for a COVID-19 vaccine online could not get any more shambolic, the website used for registrations was abruptly taken offline on Monday due a purported data breach.

 

Reports first surfaced on social media over the weekend that a glitch in the website meant that some user data was accessible to the public.

 

It appeared that it was possible to view the personal information of the last person who registered on the site. The data on display included name, address, date of birth and passport number.

 

On Monday, blogger Richard Barrow appeared to confirm the data leak.

 

“URGENT WARNING: If you are using the http://thailandintervac.com website to register for a vaccine appointment, please be aware ALL of your personal details are freely available”, Richard tweeted.

 

In a series of tweets, Richard explained how he was able to access the information of a different user every “five or ten minutes”.

 

Richard made it clear that he was not hacking the website but that the personal information was open to anyone who was using the site.

 

Normally you would need username/password to edit user information. I’m not doing that. Every five or ten minutes there is a new name. I am presuming Peter from Prachuap Khiri Khan was the last person to register. To be clear, I am NOT hacking the site. This is open to anyone. pic.twitter.com/gsBYKoQS3W

— Richard Barrow (@RichardBarrow) June 14, 2021

 

Other users commenting on Richard’s Twitter thread posted screenshots which also appeared to confirm they too were able to access other people’s information.

 

The website being taken offline is the latest in series of embarrassing issues related to foreigners in Thailand being able to register for vaccinations.

 

Today (June 14) was meant to be when the online registration portal was available to all foreigners in Thailand, however, the website has recently been updated to say that registrations are not currently available.

 

-- © Copyright Thai Visa News 2021-06-14

 

- Whatever you're going through, the Samaritans are here for you

- Follow Thaivisa on LINE for breaking COVID-19 updates

 

[Almer]

No more than a delay tactic

[BEngBKK]

Well....Testing has newer been Thais strong side ????

[holy cow cm]

And as I just said never would I do and trust the registration because of something like this, and then got sad and confused emoji from many people, it has happened. Hahahaha is all is have to say. 

[MRToMRT]

Server is down now

 

 

[BEngBKK]

I registrered for C19 vaccination on my private hospital.

By mistake I entered my patientId wrong and a Thai's name came up and I could "press OK to confirm"... ????

(I cancelled) 

[masvil]

Government at work:

"Anyone know how to publish a form on the web?"

"Yes, a friend of my son is good at these things!"

"OK, call him."

Edited June 14, 2021 by masvil

[metisdead]

A post with a trolling video has disappeared. 

[holy cow cm]

10 minutes ago, MRToMRT said:

Server is down now

 

 

Hopefully not because of a racket.

[timendres]

Classic. We tried to bid for government projects, but quickly learned the futility of the exercise. They simply do not care about professional results.

[Denim]

I smell another hub of something in the making.

 

Thais and website design. Not the best of combinations.

[BEngBKK]

20 minutes ago, NCC1701A said:

NEVER use Thai GOVERNMENT web sites or apps for anything. 

 

90 day reporting on line at your own risk. 

 

 

At least it use HTTPS now....

But it took 8 years .... ????

[RotBenz8888]

33 minutes ago, Jonathan Fairfield said:

the website has recently been updated to say that registrations are not currently available.

If they don't want to share vaccine to foreigners, they've succeeded.... 

[Excel]

As I said in my post very early this morning that a leak was reported last night so indeed the shambles goes from bad to worse. I just hope that those who actually registered initally will not be subject to any untoward actions by bad intentioned individuals now that the data regarding names and passport numbers etc appear to have been easily accessed. Unfortunately this government will deny its responsibility no doubt. Anybody who registered giving these details now needs to be very very wary.

Edited June 14, 2021 by Excel

[samtam]

It's up again now, but without any "edit" button, so I cannot even attempt another 3000 times to add in the information that keeps getting dropped...

1) nationality

2) Organisation

3) Province

4) District

5) Sub-district

etc

And all it shows is that I have not completed the data, (I have multiple times), and that I need to "reload". I'm sure there is no rush to fix this, as there is a vaccine shortage, which they have finally admitted. Leave it for a week or so, or until early July (2021).

[from the home of CC]

if I was in a panic to receive the vax, I'd get on a plane and go get it. Many of the folks scrambling (in their minds) about not getting 'on the list' would be walking unmasked petri dishes by their own actions if all the bars were open (as folks did in the west). The vaxes will be available when they're available and Mr. Barrow pointing out a wonky website won't put them in peoples arms any sooner (no matter if he is a legend in his own mind). Quit all the whining, it will change absolutely nothing except pollute the air. I still see lots of westerners maskless or wearing them below their nose so folks can't be that worried lol..

[daveAustin]

41 minutes ago, Jonathan Fairfield said:

Other users commenting on Richard’s Twitter thread posted screenshots which also appeared to confirm they too were able to access other people’s information.

Not surprised. No news here. Go to any IO and they’ll show examples of how to fill in forms complete with personal details. Competence and confidentiality ain’t their strong points. 

[8OA8]

Just to add to this website glitch. If you've forgotten your password and hit the Forgotten password button. The site then asks that you type In your email address and phone number.

But they don't then send you an email with the new password to the email address you've just given,   they also don't send an SMS to your phone number that you just typed in. What they do is show it to you on the page you are viewing and then you are directed to log in using that new password with your email address. 

 

[connda]

46 minutes ago, Jonathan Fairfield said:

The data on display included name, address, date of birth and passport number.

That's special, now isn't it.  Sorry for you folks who wanted to be first in line.  I can just imagine the amount of identity theft damage that can be accomplished with that amount of data.

[Darbar]

What about accountability for the data breach?

 

Thailand does have data protection laws...

 

Which development company are responsible? (Looking at the HTML code of the site, this is very easy to find, if you know where to look, and quick google search) - Not mentioning it publically due to various one-sided & unfair laws.

 

I know there will 99.99999% be zero accountability for public disclosure of names, addresses, phone numbers, passport numbers, and that's a comeplete shambles. I'm one of the individuals with leaked data, and now know there is a much-heightened risk of identity theft due to this, when all I was attempting was to secure a vaccine for this disease.

 

Until real accountability exists for monumental <deleted>*k-up's like this, they will continue to happen, and round and round we go.

 

Can we get some REAL accountability for ONCE? ... I won't hold my breath.

 

[IvorBiggun2]

Sorry to squeeze this in but I dunno where to ask. Some farang the other day posted a photo of himself receiving his Covid injection. Anyone know which thread it was on? Reason why I ask is because a  senior nurse at my local hospital refuses to believe farangs are getting the vaccines. Her hospital has a 'no farang' policy.

[racket]

Who cares? After all these are the same people who rush to social media to show off their degenerated jab to everyone else for immediate attention. 

[LivinLOS]

19 minutes ago, samtam said:

It's up again now, but without any "edit" button,

Not on my connection it isnt.. 

 

[TallGuyJohninBKK]

20 minutes ago, samtam said:

It's up again now,

 

I'm trying both sites now, and still getting the same "unable to connect" message.

 

[connda]

25 minutes ago, 8OA8 said:

But they don't then send you an email with the new password to the email address you've just given,   they also don't send an SMS to your phone number that you just typed in. What they do is show it to you on the page you are viewing and then you are directed to log in using that new password with your email address. 

Which is why they were so easily hacked. 
I suspect that software development contracts have more to do with nepotism than professional ability.

 

Edited June 14, 2021 by connda

[Puwa]

38 minutes ago, holy cow cm said:

Hopefully not because of a racket.

Whose fault?

[from the home of CC]

oh my God, this is earth ending! lol..

[samtam]

4 minutes ago, LivinLOS said:

Not on my connection it isnt.. 

 

Well, it was briefly on this...

http://thailandintervac.com/logout.php

(but not just now, I agree).

Edited June 14, 2021 by samtam

[holy cow cm]

4 minutes ago, Puwa said:

Whose fault?

 

It was like a tennis joke.

 

Posted 42 minutes ago

  53 minutes ago, MRToMRT said:

MRToMRT: Server is down now

 

Holy Cow CM: Hopefully not because of a racket.

[Puwa]

5 minutes ago, holy cow cm said:

 

It was like a tennis joke.

 

Posted 42 minutes ago

  53 minutes ago, MRToMRT said:

MRToMRT: Server is down now

 

Holy Cow CM: Hopefully not because of a racket.

Exactly: server, racket, fault. Try to keep up.