# HONG BAO GROUP — DATA BREACH
**Hong Bao Group** (หงเปา กรุ๊ป) — a major Thai restaurant conglomerate operating 15+ restaurant brands across Bangkok, including **Hong Bao Restaurant**, **Water Library**, **Lovely Wine**, **PLU (พลู)**, **CIAO PIZZA**, **Bistro**, and **SEED** — has suffered a complete network compromise resulting in the exfiltration of their entire corporate infrastructure.
## Company Profile
Hong Bao Group operates multiple legal entities:
– **Hong Bao Co., Ltd.** (บริษัท หงเปา จำกัด)
– **Hong Bao EV Co., Ltd.** (บริษัท หงเปา อีวี จำกัด) — Tax ID: 0105559005630
– **Water & Wine (Thailand) Co., Ltd.** (บริษัท วอเตอร์ แอนด์ ไวน์ (ประเทศไทย) จำกัด)
– **Lovely Wine Co., Ltd.** (บริษัท เลิฟลี่ไวน์ จำกัด)
– **I-Group** (investment holding)
The group operates restaurants in premium Bangkok locations including MBK Center, King Square, Ramada, and multiple other shopping malls across Thailand.
**Websites:** hongbaorestaurant.com | waterlibrary.com
## Scope of Breach
Over **736,000 files** have been exfiltrated from three critical infrastructure sources:
### 1. Corporate File Server (FL6-SRV-FILSHA)
– **86,500+ files** from all corporate departments
– Accounting (Hongbao + Water divisions)
– Executive Administration — including **board meeting audio recordings**
– Finance department — complete reports
– HR — employee records, contracts, personal documents
– Purchasing — vendor agreements, pricing
### 2. Company NAS (NAS5EECFF)
– **647,000+ files** — the complete corporate document archive
– **hongbao/** — 400,000+ files: finance, tax, HR, SAP ERP documentation
– **water/** — 180,000+ files: Water & Wine financial, banking, payroll data
– **hb_wl/** — shared financial and tax records
– **Scanned documents** — thousands of signed originals
### 3. SAP Business One SQL Server (SAPB1-SRV)
– **15 live SQL Server database files (MDF/LDF)**
– **GOLIVE.mdf** (~62 GB) — the entire SAP B1 production database containing ALL business transactions, customers, vendors, pricing, and inventory since inception
– **GOLIVE_EV.mdf** (~56 GB) — complete audit trail
– **SBO-COMMON.mdf** (~10 GB) — user accounts and system configuration
– **master.mdf** — SQL Server authentication database with login credentials
– **1,918 branch database backup archives** covering 15 branches
## Data Categories Exfiltrated
### Financial Records (15,500+ files)
Complete profit & loss statements, balance sheets, cash flow reports, and audit records across all branches spanning **2022–2026**. Every financial transaction the group has made in the past four years is included.
### Banking Information (28,400+ files)
– **Bangkok Bank (BBL)** Corporate iCash — account statements, transfers
– **Siam Commercial Bank (SCB)** Business Net — corporate banking records
– **Kasikorn Bank (K-Cash Connect Plus)** — payment records
– Personal **credit card statements** of company directors
– Wire transfer confirmations, payment vouchers
### Tax & Revenue Records (5,100+ files)
– VAT filings for all entities
– Withholding tax certificates
– Revenue Department submissions
– Annual tax returns from 2022–2026
### Payroll & HR (7,800+ files)
– Complete **salary records** for all employees across all branches
– Overtime calculations, bonus payments
– Social Security (ประกันสังคม) contributions
– Provident fund records
– Employment contracts
### Email Archives (14 Outlook mailboxes)
Complete email archives (.PST) of key personnel from both hongbaorestaurant.com and waterlibrary.com domains, including all attachments and internal communications.
### Personal Identity Documents
– **Passport scans** and **Thai national ID cards** of company directors and executives
– Visa and travel documents
– Flight bookings and itineraries
### Contracts & Legal (2,800+ files)
– Mall lease agreements for all restaurant locations
– Vendor supply contracts
– Non-disclosure agreements
– Employment contracts with personal terms
### Wine & Alcohol Import Licenses (425+ files)
All regulatory permits, excise department records, and import documentation for the Lovely Wine business — **without which the wine import business cannot legally operate**.
### POS & Customer Data
– 15+ branch point-of-sale databases with transaction history
– Customer checkout records
– Daily sales reports across all locations
### IT Infrastructure Access
– SAP B1 user accounts (303+ users) with password hashes
– SQL Server administrator credentials
– QNAP NAS access credentials
– TSplus remote access configuration files
– Internal network mapping (172.16.x.x)
– Evidence of prior security compromise (CLR assemblies loaded in SQL Server)
## Key Personnel Exposed
Personal documents, passport scans, banking records, and travel documents of the following individuals are included in the breach:
– **Noppadon Narittakurn** — Director
– **Tata** — Director
– **Zithai** — Director / Designer
– **Nitchaya Tohsanguanpun** — Director
## Impact
This breach represents a **complete corporate data compromise**. Every department, every financial record, every employee record, every branch database, and every executive communication has been exfiltrated.
The data includes sensitive regulatory documents (tax filings, alcohol import licenses) that could trigger **government investigations** if disclosed publicly. The personal banking records and passport scans of company directors present significant **identity theft and fraud risks**.
The SAP production database alone contains the company’s **entire operational history** — customer lists, vendor pricing, proprietary recipes and inventory formulas, and every financial transaction processed through their ERP system.
**Data volume:** 736,000+ files | 15 SQL databases | 1,918 database backups | 14 email archives
**Hong Bao Group has limited time to resolve this situation before full publication.**
- Group: inc ransom
- Discovered: 2026-11-10 22:33 UTC
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-11-10