The Philippines' National Privacy Commission (NPC) confirmed on Tuesday, November 10, that 10 national government agencies had filed personal data breach notifications. The list includes the Bureau of Internal Revenue (BIR), the Securities and Exchange Commission (SEC), the Department of Information and Communications Technology (DICT) and the Philippine Coast Guard. The numbers do not line up. Paktechstan reports that the country's cybercrime body says hackers claim to have hit about 20 agencies. Deep Web Konek, a civilian monitoring group based in the Philippines, counted 23 affected institutions in underground forum posts from November 5 to 7, according to The Philippine Star. Its count includes law enforcement, military and education targets as well as national agencies. The Department of the Interior and Local Government (DILG) has since disclosed its own breach, so at least 11 agencies have now confirmed incidents. The NPC has not said how many people are affected or whether the incidents are connected.
What Happened
Deep Web Konek published an assessment of underground forum disclosures covering November 5 to 7. It flagged leaks it said involved millions of personal, corporate and administrative records, plus one website defacement. The groups named in that report include "DeathNote Hackers," "Happy Go Lucky PH," "sinigangmixwithgabi," "core849" and "CrimsonSec Philippines."
The NPC's first response was cautious. The Philippine News Agency, the state news service, reported the commission's statement that it had not yet received breach notifications "as of Friday." The NPC added that "reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred." By Tuesday, November 10, that had changed. ABS-CBN, Rappler and The Philippine Star all report that the NPC confirmed notifications from these 10 bodies:
- Presidential Commission on Good Government
- Department of Information and Communications Technology
- Department of Labor and Employment, through its Bureau of Local Employment
- Bureau of Internal Revenue
- Philippine Amusement and Gaming Corporation
- Department of Justice, through its Office for Alternative Dispute Resolution
- Securities and Exchange Commission
- Philippine Coast Guard
- Department of Trade and Industry
- Department of Science and Technology's Philippine Institute of Volcanology and Seismology (Phivolcs)
Rappler reports that the DILG later disclosed a breach of its Local Government Unit Support System-Barangay Information Management System (LGUSS-BIMS). The DILG says it is coordinating with the NPC.
Several organisations named in Deep Web Konek's report are not on the NPC's list. These are the Office of the Vice President, the Department of Transportation, the Land Transportation Office and the Cybercrime Investigation and Coordinating Center. None of them has confirmed a breach. The Philippine Star reports a DICT official saying all breaches have been contained. The NPC has not confirmed this.
What Was Taken
Agencies have confirmed only part of the data involved:
- SEC: On November 9 the SEC said usernames, email addresses, phone numbers, birth dates and tax identification numbers may have been exposed.
- BIR: A November 10 advisory says some taxpayer profile information may have been exposed. The BIR says filing and payment records were not compromised and no data was modified or lost.
- DILG: Records of Barangay Inhabitants (barangays are the smallest local government units) may have been exposed. These contain residents' names, civil status, occupation, address and contact details. They also record whether a resident has a disability, is an overseas Filipino worker or is a solo parent.
The figures below come from the attackers, as compiled by Deep Web Konek. None has been independently verified.
- Department of Labor and Employment: DeathNote Hackers claim 19.2 million records, about 5.74GB, taken on November 5.
- Office of the Vice President: The same group claims about 12,979 PDF files, roughly 10GB. The OVP is not on the NPC's list.
- Philippine Coast Guard: DeathNote Hackers claim about 1.35GB across 6,698 files and 3,411 folders. They say it includes personnel details, rescue records, images and location data.
- Department of Transportation: The "sinigangmixwithgabi" actor claims HR system data on about 4,534 employees. The claim covers payroll, attendance logs, account records, biometric identifiers and application source code.
Across all the claims, the data types listed include government IDs, taxpayer and corporate registration details, HR and payroll records, student files and operational logs.
Why It Matters
Several different groups appear to have targeted Philippine government systems at the same time, and the agencies hit hold tax, labour, corporate registry, maritime and local resident data. Together, that data is enough to support identity fraud and very convincing phishing. Because the NPC still has not said who was affected or how, citizens cannot tell whether their own records were exposed. The NPC has already warned the public to watch for suspicious messages and links that refer to the breaches.
The wave also follows earlier incidents. Dark Reading reports that threat intelligence firm Hunt.io found evidence, in an analysis dated October 28, that an unknown actor took about 69GB of SQL Server backups from the Philippine Overseas Employment Administration. Those backups covered overseas workers, contracts and LandBank cashier records. In August, Hunt.io found another actor holding 1.2GB of data stolen from a Philippine nuclear regulatory agency and a shipbuilding contractor. Nothing published so far links these intrusions to the November wave, and Dark Reading notes it is unclear whether a state or a criminal group is behind the overseas employment breach.
The regulator is making clear that agencies will be held responsible. NPC Deputy Privacy Commissioner Jose Belarmino II said that filing a notification "does not absolve agencies of liability." Penalties can include administrative fines and, if criminal violations are proven, imprisonment and damages. He also said the agency, as data controller, stays accountable even when a third-party processor was involved.
The Attack Technique
No agency has publicly said how attackers got in. According to Rappler, the SEC attributed its incident to malware and unauthorized access, but has given no technical detail.
The overseas employment breach gives the clearest public picture of methods used against Philippine government systems, although it has not been tied to this wave. Hunt.io found logs on a staging server in Singapore. They show the attacker using the GodPotato privilege escalation tool and abuse of the Windows SeImpersonate privilege to gain higher access. The attacker then used the Impacket Python library to copy 27 backup databases in 24 minutes. Esteban Borges, Hunt.io's head of research, told Dark Reading that the trail ends at the staging server. Someone accessed that server later, and it is not known who.
What Organizations Should Do
- Hunt for privilege escalation and Impacket use. On Windows servers, look for GodPotato-style token impersonation by service accounts with SeImpersonate rights, and for Impacket activity such as smbexec, wmiexec and secretsdump. Remove SeImpersonate from service accounts that do not need it.
- Lock down database backups. Store SQL Server backups encrypted, on separate storage with tight access controls. Alert on large or unusual backup reads and outbound transfers. The overseas employment theft took less than half an hour.
- Watch underground forums for your own name. These incidents surfaced through forum posts before agencies confirmed them. Monitor for mentions of your organisation and have a plan for checking leak claims quickly.
- Meet the 72-hour deadline. Philippine law requires notifying the NPC and affected individuals within 72 hours of discovering a breach. Have notification templates and decision rules agreed in advance, and include incidents at third-party processors.
- Prepare for phishing that uses the leaked data. Warn staff and the public that messages quoting real tax IDs, birth dates or employment details may be fraudulent. Publish a single official channel for breach updates.
- Protect HR and resident data in particular. The claims single out payroll, biometric and local resident records. Apply strict access controls, logging and data minimisation to those systems first.
Sources: Philippines Confirms Data Breaches at 10 Government Agencies — Hack... | Philippine Migrant Worker Data Likely Leaked in 69GB Breach | DILG is latest government agency to report data leak | NPC sounds alarm as 10 gov’t agencies report leaks | NPC confirms data breach in 10 government agencies Philstar.com | PH privacy body verifying reported data leaks in gov't agencies Ph... | Massive cyber attacks hit 23 government, private sites Philstar.com | NPC confirms data breaches in 10 gov’t agencies; warns public again...