Secure Networks Against Physical Taps and Cross-Border Data Siphoning

Thai police disrupted a criminal operation that used a physical fiber-optic cable to steal internet bandwidth from Thailand for use in Myanmar. Officers in Kanchanaburi province intercepted the infrastructure, which was supplying an illegal border casino and a suspected cyber scam compound with high-speed connectivity across the international border.

The investigation began when authorities responded to reports of unusual internet usage in the village of Nong Lu. Police discovered that two homes in the area were consuming bandwidth levels typical for an entire village. This anomaly led to the discovery of a robust, 48-core fiber optic cable strung along pylons. The cable stretched 350 meters across the border, directly into Myanmar’s Three Pagodas Pass, a region known for cybercrime hubs.

Infrastructure and Bandwidth Theft

The intercepted cable was transferring roughly 6 terabytes of data every day. According to the National Broadcasting and Telecommunications Commission, this volume is sufficient to serve 300 to 400 users. Instead of serving legitimate customers, the bandwidth was illegally routed to keep the scam compound online. The operation relied on local cooperation, with an unidentified suspect reportedly receiving 700 baht daily to allow the cable to run through his house.

Regional Crime Context

This incident reflects broader trends in Southeast Asian cybercrime. Myanmar has increasingly become a central hub for global scam operations, a role previously held by Cambodia. Reports indicate that Chinese-led scam bosses are shifting toward decentralized operations in small hotels and villas rather than large factory-style compounds. These activities are often protected by ethnic armed militias, and NGOs allege that hundreds or thousands of people are trafficked into the trade in this region.

What to watch

Small-business owners should monitor their network performance for unexplained spikes in bandwidth consumption that do not align with normal operational patterns. Any sudden increase in data usage could indicate unauthorized access or infrastructure tampering. Additionally, businesses located near border regions or with complex physical infrastructure should ensure that all external connections are physically secured and regularly inspected for signs of tampering or unauthorized taps.

What made it possible

Attacks like this rely on physical access to network infrastructure, bypassing digital security controls entirely. The weakness lies in the assumption that perimeter defenses protect internal data, ignoring the risk of direct hardware manipulation. This stage serves the initial access and command-and-control phases of an intrusion, providing attackers with a reliable, high-bandwidth channel. Teams usually secure physical entry points and monitor for unauthorized cabling, ensuring that all network connections are accounted for and protected against physical interception or diversion.

What to do and how to stay safe: fiber optic

• Physically inspect external network cables and entry points for signs of tampering or unauthorized connections.
• Monitor network bandwidth usage for anomalies that suggest data is being siphoned or redirected.
• Implement strict access controls for physical infrastructure areas, including server rooms and cable pathways.
• Collaborate with local authorities and telecommunications providers to report suspicious infrastructure activity.

Step-by-step guide: Multi-Factor Authentication Setup for Small Teams

General security guidance from the Shell Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

How much data was being stolen via the fiber optic cable?

The cable was transferring approximately 6 terabytes of data per day to the scam compound in Myanmar.

Where was the illegal cable discovered?

It was found in Nong Lu village in Thailand’s Kanchanaburi province, running into Myanmar’s Three Pagodas Pass.

Why were local homes involved in the operation?

Residents were paid small daily amounts, such as 700 baht, to allow the cable to pass through their properties.