Lang Suan Prison

Summary

Thai authorities investigated a hack of surveillance cameras at a prison in southern Thailand, where an unknown external actor broadcast live footage of inmate activities on YouTube for several hours. The Corrections Department confirmed the breach at Lang Suan Prison, prompting immediate shutdown of the camera system, an internal investigation, and a police complaint. The unauthorized broadcast, originating from outside the country, was later removed from the platform, which also hosted other unrelated security camera feeds.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On December 25, 2019, Thai authorities confirmed an investigation into a cybersecurity breach at Lang Suan Prison in Chumphon province, southern Thailand. An unidentified hacker external to Thailand compromised the facility’s surveillance camera system, accessing multiple security feeds that captured prisoners’ daily activities. The intrusion enabled the unauthorized live broadcast of prison footage on a YouTube channel named "BigBrother’s Gaze" for several hours on December 24. The channel’s operator inaccurately labeled the content as originating from a Bangkok prison. Thai media first reported the incident after discovering the live stream, which prompted a reporter to alert corrections officials. The breach exposed operational details of the prison environment through camera angles positioned across different areas of the facility. Officials verified the hack targeted internet-connected surveillance devices but did not specify the number of cameras accessed or the exact duration of unauthorized system control beyond the broadcast period.

The Corrections Department responded by immediately deactivating the compromised surveillance system upon learning of the breach. Police Colonel Narat Sawettanan, the department’s director-general, ordered Lang Suan Prison’s commander to file a formal police complaint and initiate an internal investigation. By December 25, the YouTube channel had removed the prison footage but continued hosting unrelated content, including feeds from a Thai corporate office, public areas in Salt Lake City, an Australian office, and an Amsterdam café. Authorities emphasized the incident highlighted vulnerabilities in Internet of Things (IoT) devices, noting that inadequate security practices often leave networked equipment like cameras exposed to remote exploitation. No additional technical details about the attack vector, data exfiltration, or prisoner identities were disclosed publicly. The breach underscored institutional reliance on interconnected systems without confirming whether prior security assessments had been conducted at the facility.

Sources

Sources available to members: 1 source.