Government systems encounter 254,442 cyber-attacks every month, Prime Minister Jotham Napat told Parliament during the 2026 Second Ordinary Session, highlighting the growing risks and costs of protecting the country’s digital infrastructure.

A National Cybersecurity Agency established by the passing of the Cybersecurity Act 2026 will be the lead national authority responsible for coordinating cybersecurity policy, setting technical standards and advising the Minister and Council of Ministers.

Law Strengthens Protection of Critical Systems

During the debate, the Prime Minister referred to the November 2022 ransomware attack on the Government’s broadband network, which disrupted government email systems, shared drives and voice services.

Critical information infrastructure supporting hospitals, government financial services and other public services was also affected. The disruption stopped revenue collection, licensing procedures, court administration and other government activities. Recovery took several months and required support from development partners.

Under the new Act, operators of designated critical information infrastructure must conduct annual cybersecurity audits, maintain risk management plans, appoint a chief information security officer or equivalent, report serious cyber incidents and participate in national cybersecurity exercises.

The law also allows the Minister to declare a national cyber emergency when a serious incident threatens national security, public safety, the economy or essential services.

Government Outlines Cybersecurity Spending

Mr Napat said the Government had engaged a Japanese cybersecurity company following the 2022 attack, with VT100 million allocated under a three-year contract to help strengthen government protection systems, including firewalls.

He said maintaining the Government’s systems and protecting them from cyber threats cost about VT80 million annually.

The Prime Minister also told Parliament that VT180 million had been allocated through the National Priorities Programme this year to strengthen security measures across critical infrastructure, particularly information infrastructure.

He said cyber threats were becoming more serious and that the cost of responding to attacks made it important for the country to invest in stronger systems and policies.

The Cybersecurity Act 2026 establishes legal responsibilities for operators of critical information infrastructure, introduces mandatory reporting requirements and provides the Government with a legal basis to respond to serious cyber incidents.