An unidentified attacker copied 27 Microsoft SQL Server backup files linked to the Philippine Overseas Employment Administration (POEA) on September 6, 2026. The transfer took 23 minutes and 46 seconds. Threat intelligence firm Hunt.io found the evidence in transfer logs the attacker left on a publicly accessible staging server in Singapore and published its analysis on October 28. Reports of the volume range from "68GB" (Gulf News, Rappler) to "nearly 69GB" (Dark Reading). Hunt.io's log figure is 68.837 GiB. The Philippines' National Privacy Commission (NPC) confirmed on October 29 that it is investigating and coordinating with the Department of Migrant Workers (DMW), which has absorbed POEA's functions. The filenames point to overseas worker contracts, accreditation and payment records. However, no one has yet confirmed what the backups actually contain or how many people are affected.
What Happened
Hunt.io found a working directory exposed through an unauthenticated HTTP service on a server hosted by UpCloud in Singapore, according to Newsbytes.PH and Breach Signal. The directory held transfer and access logs, hacking tools, source code and other files. The logs show 27 database backups being pulled out and the transfer finishing. In Hunt.io's words to Rappler: "A thief copied the data, kept a receipt of it, then left that receipt and their tools on a computer anyone online could open. That mistake is how it came to light, not a public dump of the data."
Hunt.io also found that network addresses tied to DMW portals had downloaded files from the attacker's server. Newsbytes.PH reports the firm linked these addresses to apps.dmw.gov.ph and legalassistance.dmw.gov.ph using domain records and digital certificates, including a wildcard certificate for the agency's government domain. One plausible reading is that the attacker was running tooling from inside DMW infrastructure. Hunt.io has not said that outright.
The trail ends at the staging server. Esteban Borges, Hunt.io's head of research, told Dark Reading that someone accessed the server later but it is unclear who. "I won't claim the backups stopped on the staging server," he said. He added that it is "still a breach, since the data was copied out of the agency's control and the log shows the transfer completing." Hunt.io has not seen the data advertised for sale.
Hunt.io says it notified CERT Philippines and the DMW before publishing. NPC spokesperson Roren Chin said the commission is "conducting an investigation to assess the facts and circumstances of the incident and determine whether any violations of the Data Privacy Act (DPA) of 2012 have occurred." The DMW has not publicly said what the files contained.
Conflicting account. Atlabyte reports a different version of events. It credits researcher Jeremiah Fowler with finding a non-password-protected database, says his analysis was published on July 2, and dates the backups to June 2024. No other outlet repeats any of these details. They conflict with the September 6 transfer date and the Hunt.io discovery that every other report describes. Atlabyte may have merged this incident with an earlier exposure, so readers should treat its timeline with caution.
On the possible link to the September DMW story. The transfer happened in September and the filenames point at systems DMW now runs, so it is reasonable to ask whether this is the same intrusion as other September reporting on DMW. Hunt.io has not drawn that connection, and neither DMW nor the Department of Information and Communications Technology has said whether the two are related. For now they should be treated as possibly linked, not confirmed as the same event.
What Was Taken
What is known about the contents comes from the filenames alone. Hunt.io did not download or examine the backups, Rappler and Gulf News report, so it cannot confirm their contents or the number of people affected. According to Breach Signal and Tech Watch PH, the filenames include:
- POEA_EServices, POEA_HelpDesk and POEAHelpDeskDB
- OFW and OfwDB (overseas Filipino worker records)
- Variants covering accreditation, repatriation, eContracts, Cashier and LandBank
- References to the Balik-Manggagawa system, which returning overseas workers use (Gulf News, Rappler)
If the files match their names, they would cover the core of overseas employment case management: recruitment agency accreditation, worker employment contracts, repatriation cases, and payment records involving the state-owned Land Bank of the Philippines. A full SQL Server backup holds an entire database, so these would be complete databases, not partial extracts.
Gulf News says plainly that investigators "have not established whether the files contained personal information or whether anyone accessed it." No official count of affected individuals has been released.
Why It Matters
Overseas Filipino workers number in the millions. Their records usually tie identity details to employers, contract terms, recruitment agencies, and payment flows. Breach Signal reports Hunt.io's view that migrant worker personal data combined with contract and payment records has commercial value for fraud and identity theft. That could include recruitment scams, impersonating licensed agencies, and fake fee collection aimed at workers abroad.
This is also not the first time this year that Philippine government data has turned up in an attacker's workspace. Dark Reading notes that in August, Hunt.io found another operator's server holding 1.2GB stolen from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor.
Attribution is open. Hunt.io has not tied the activity to any country or criminal group. Tech Watch PH reports that some source files contained Chinese-language comments, and Breach Signal says those fragments were in third-party code. Either way, Hunt.io considers them too weak to identify the operator. Dark Reading likewise reports it is unclear whether a state or a criminal group was behind it.
The bigger lesson for defenders is that this incident came to light only because the attacker made a mistake. Nothing in public reporting suggests the agency's own monitoring caught 69GB of database backups leaving its network. Backup stores often have weaker controls than production databases while holding the same data.
The Attack Technique
How the attacker first got in is unknown. Hunt.io told Gulf News it could not establish the initial access vector or where the copied files ended up. The tooling recovered from the staging server shows what happened after that point:
- Privilege escalation: GodPotato, which abuses the Windows SeImpersonatePrivilege right to move from a service account to SYSTEM (Dark Reading). Service accounts for IIS, SQL Server and similar software hold this privilege by default, which makes it a reliable escalation path on Windows servers that run web applications.
- Lateral movement and transfer: Impacket, the Python library for working with Windows network protocols such as SMB, used to move the data (Dark Reading).
- Targeting: The attacker went for SQL Server backup files (.bak) instead of querying live databases. That route skips application-layer logging and produces one large file per database that is easy to move.
- Staging: Data went to a rented UpCloud server in Singapore, and the attacker left the working directory open to anyone on the internet.
Dark Reading sums up the attacker's profile as neither top-tier nor amateur. They were fast and selective in what they took, but careless about protecting their own infrastructure.
What Organizations Should Do
- Treat backup stores as production data. Keep database backups on separate, access-controlled storage. Encrypt them at rest with keys the SQL service account cannot read, and log every time a .bak file is read.
- Alert on large outbound transfers. Tens of gigabytes leaving a database or file server to a foreign hosting provider in under half an hour should trigger an alert. Set baselines for outbound volume on servers that hold backups.
- Remove SeImpersonatePrivilege where it isn't needed. Audit which service accounts hold it. Run IIS and SQL Server under virtual or managed service accounts with the least privilege possible, and watch for Potato-family tools and unexpected SYSTEM-level child processes of web or database services.
- Hunt for Impacket. Look for its signatures: smbexec and wmiexec service creation, output redirected to ADMIN$ shares, and odd remote SMB file reads from accounts that are not administrators.
- Check public-facing portals for misuse. The DMW-linked addresses that downloaded from the attacker's server suggest web portals may have been used as footholds. Review web servers and certificates under your domain for unauthorized outbound connections.
- Prepare to notify the people affected. For agencies holding migrant worker or citizen data, have notification and fraud-warning templates ready before forensics finishes. Workers abroad are often the first people targeted by scams that use stolen data.
Sources: POEA Data Breach Exposes 69GB of Philippine Worker Records | Philippine Migrant Worker Data Likely Leaked in 69GB Breach | Hunt.io reports theft of nearly 69 GB of backups linked to Philippi... | Philippines probes suspected theft of 68gb of migrant worker data | Philippine POEA backups copied in data breach | NPC probes alleged theft of 68GB of DMW-linked database ... | Anonymous Operator Exfiltrated 69GB of Data from Philippine Agency... | 68 GB of stolen PH gov’t data found online, says cybersecurity firm