Phetchabun Hospital

Phetchabun Hospital is a healthcare institution located in Thailand. It provides medical services to the population seeking diagnosis, treatment, and preventive care. The hospital offers inpatient admissions for patients requiring overnight observation or surgery. Outpatient consultations are available for routine check‑ups, specialist referrals, and follow‑up visits. Emergency care is delivered around the clock to address acute medical conditions. The facility supports public health initiatives such as vaccination campaigns and health education programs. Medical staff include physicians, nurses, allied health professionals, and administrative personnel. The hospital operates under the regulatory framework of Thailand’s Ministry of Public Health. Its name reflects the geographic area it primarily serves, linking it to the Phetchabun region. As a provider of clinical care, it maintains standard departments such as internal medicine, surgery, pediatrics, and obstetrics.

On September 7, 2021, a hacker gained unauthorized access to Phetchabun Hospital’s information systems. The attacker exfiltrated personal data belonging to more than 10,000 patients. Initial statements from hospital officials characterized the leaked information as “not important,” seeking to minimize public concern. Concurrently, social media channels circulated claims that up to 16 million patient records were being offered for sale on illicit markets. The hospital publicly disputed the larger figure, asserting that the breach was limited to the confirmed subset. Subsequent forensic analysis revealed that the stolen dataset included health‑related details such as diagnoses, treatment histories, and prescription information. This finding contradicted the earlier downplay and demonstrated that sensitive medical information had been compromised. The incident prompted discussions about the adequacy of cybersecurity controls within Thai healthcare facilities. It also highlighted the need for timely breach notification and transparent communication with affected individuals. Following the event, the hospital likely undertook remedial measures to strengthen its data protection practices, although specific post‑incident actions are not detailed in the available sources.