BusOnlineTicket Thailand targeted by killsec with ransom demand

• Ransomware group: killsec
• Country: Thailand
• Sector: Transportation
• Announcement date: September 10, 2025

Killsec claims data breach at BusOnlineTicket Thailand

The threat actor group known as killsec has officially listed BusOnlineTicket Thailand on its leak site. According to the announcement made on September 10, 2025, the group claims to have gained unauthorized access to the institution's data. Following this alleged breach, the threat actors have issued a ransom demand of 5,000 EUR to the organization.

The incident was announced on the same day it was claimed to have occurred. This type of activity is characteristic of modern ransomware operations, where threat actors often employ double extortion tactics. In such scenarios, attackers not only encrypt an organization's internal systems but also exfiltrate sensitive information to use as leverage, threatening to publish the stolen data on public leak sites if the ransom is not paid.

Details of the alleged data leak

The killsec group has provided evidence to support its claims by posting samples of customer transaction records. These samples are allegedly taken from the institution's online ticketing platform. The information presented in the leak includes screenshots of official receipts, which demonstrate the nature of the data the group claims to possess.

Based on the information provided by the threat actor, the following types of data are allegedly involved in the breach:

• Customer names
• Customer phone numbers
• Customer email addresses
• Ticket booking details

The presence of such specific transaction records, including reference numbers and booking dates, suggests that the leaked information is tied directly to the platform's core operational functions.

About BusOnlineTicket Thailand

BusOnlineTicket Thailand is an online travel platform that provides booking services for buses, trains, and ferries across Thailand. It allows users to compare and purchase tickets from various transportation operators, serving as a centralized hub for travelers in the region.

Analysis and implications of the threat

This announcement by the killsec group suggests that the institution's customer data may have been subject to unauthorized access. The potential leak of personal information poses significant risks to the affected individuals, as stolen data could lead to customers being targeted by identity theft or phishing attacks. Such attacks often use stolen contact details to deceive victims into revealing further sensitive information or financial credentials.

The group responsible, killsec, emerged in 2023 and has been reported to have hacktivist origins, though it now provides ransomware services. This evolution in their operational model introduces additional risks, such as the possibility that the stolen data could be sold on secondary markets to other malicious actors.

From a regulatory perspective, under Thailand's Personal Data Protection Act (PDPA), the institution may be required to fulfill data breach notification obligations to both the authorities and the affected individuals. When organizations face these types of threats, it is generally advisable to notify affected customers and conduct a thorough review of system security to identify and remediate the initial point of entry.

In the transportation and travel sector, where high volumes of personal and transactional data are processed, maintaining robust security posture is critical. Defensive measures typically include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring continuous monitoring of network traffic to detect anomalous behavior that might indicate data exfiltration.