Thai Film Industries PCL Data Breach

thegentlemen listed Thai Film Industries PCL, a Thai media company operating at thaifilm[.]co[.]th, as a claimed victim on August 30, 2026. SOCRadar CTI’s analysis of stealer-log data revealed four compromised employee credentials accessible through phpMyAdmin, admin panels, and file management interfaces. These credentials were dated between November 16, 2025, and January 13, 2026, indicating that initial access was likely established several months before the public claim. This long precursor suggests a sophisticated attack preparation phase. thegentlemen has demonstrated significant activity in the past 60 days, claiming 248 victims. Their primary targets have historically been in the US, UK, and Germany, with a strong focus on the Manufacturing and Technology sectors. The targeting of Thai Film Industries PCL, a media entity located in Thailand, represents an expansion of the group’s geographic reach and sector diversification beyond their typical operational profile. This incident highlights the group’s evolving tactics and willingness to strike in new regions.

SOCRadar CTI’s analysis of stealer-log data returned a “severe_exposure_in_sample” status for thaifilm[.]co[.]th. The investigation identified four employee credentials associated with the domain thaifilm[.]co[.]th. These credentials were found on phpMyAdmin, general admin panels, and file management interfaces, with timestamps indicating usage between November 16, 2025, and January 13, 2026. The presence of credentials for both database management (phpMyAdmin) and file management interfaces suggests that an attacker could potentially enumerate database schemas, stage files for exfiltration, and gain comprehensive access before initiating a ransomware deployment. The exposure of these credentials occurred up to seven months prior to the public listing by thegentlemen. This temporal gap strongly implies that the threat actor had established a foothold and likely conducted reconnaissance well in advance of the ransomware claim. The ability to access and potentially exploit credentials for critical administrative functions such as phpMyAdmin and file management interfaces points to a significant security oversight, enabling pre-attack activities that could lead to data exfiltration and subsequent encryption. Affected credentials should be treated as fully compromised. Immediate priorities include rotating all identified credentials, auditing access logs on phpMyAdmin instances and file management systems for any unauthorized activity from November 2025 onward, and reviewing any scheduled database exports or file transfers initiated during the detected exposure window to identify potential data exfiltration.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.