Le Duc Hoang Hai - The Cyber Security Incident Database (CSIDB)

Attribution profile

Type: Hacker
Location: Viet Nam
Known incidents: 1 incident
Sources: 1 source
First seen: 2017-03-01
Last seen: 2017-03-01
Updated: 2026-10-04 00:22
Aliases: 2 aliases

STIX characteristics

Threat actor characteristics are available to members.

Profile narrative

Le Duc Hoang Hai, also known as Hai, is a Vietnamese hacker who in March 2017 used a third‑party contractor’s credentials to breach Perth Airport’s computer systems, obtaining building schematics and physical security details while avoiding aircraft operational systems and traveler data. The breach was detected by the airport, reported to Australian authorities, and led to his arrest and conviction in a Vietnamese military court, where he received a four‑year sentence. In addition to the Perth Airport intrusion, Hai was found to have targeted Vietnamese infrastructure, including banks, telecommunications services and an online military newspaper. Public reports indicate he acted alone, with no evidence of collaboration with a larger group, state sponsorship, or the sale of stolen data. His known tactics relied on exploiting compromised contractor credentials for initial access; no specific malware families or tooling were described in the sources.

Incidents

Attributed incidents are available to members.

1 incident

Sources

Sources available to members: 1 source.