The Philippines' National Privacy Commission (NPC) has confirmed that 10 government agencies have reported personal data breaches, in what looks like a coordinated wave of attacks on government-held information — and the country's cybercrime body says hackers claim to have hit about twice that many agencies.
The commission said on Tuesday, November 10, that it had received breach notifications from the Presidential Commission on Good Government, the Department of Information and Communications Technology, the Department of Labor and Employment, the Bureau of Internal Revenue, the Philippine Amusement and Gaming Corporation, the Department of Justice, the Securities and Exchange Commission, the Philippine Coast Guard, the Department of Trade and Industry, and the Department of Science and Technology's volcanology institute, Phivolcs.
What was exposed — and what is still unknown
The NPC has not said how many people may be affected, what kinds of personal information were involved, whether the incidents are connected, or when and how each breach happened. Two agencies have described their own incidents publicly. The Securities and Exchange Commission said on November 9 that usernames, email addresses, phone numbers, birth dates and tax identification numbers may have been exposed. The Bureau of Internal Revenue said in an advisory on November 10 that certain taxpayer profile information may have been exposed, while stressing that filing and payment records were not compromised and no information was modified or lost.
The disclosures followed a report by cybersecurity monitoring group Deep Web Konek, which flagged a wave of data breach and exposure incidents allegedly affecting as many as 23 government agencies, law enforcement units, military units and educational institutions. Its assessment, covering underground disclosures from November 5 to 7, said the leaks involved millions of personal, corporate and administrative records, along with one website defacement.
Hackers claim 20 agencies hit
On Thursday, the head of the government's Cybercrime Investigation and Coordinating Center (CICC) said hackers had claimed breaches of around 20 government agencies — about double the number that have formally reported incidents to the privacy regulator. CICC executive director Renato Paraiso said in a radio interview that the figure was based on alleged hacks whose authors posted purported data as proof.
The gap between the two counts underlines how much remains unverified. The NPC said only that the 10 notifications it received are being assessed, and it has not said whether any of them match specific claims circulating on forums and leak sites. Separate claims have also surfaced against other agencies, including the Department of Migrant Workers and the Department of Transportation.
What happens next
Under the Philippines' Data Privacy Act of 2012, agencies must notify the commission when a breach meets the law's thresholds. NPC deputy privacy commissioner Jose Belarmino II said filing a notification is a mandatory regulatory step, but stressed that reporting alone does not absolve an agency of liability. Each notification is now being reviewed by the commission's Compliance and Monitoring Division, which will report its findings to the Commission En Banc for a decision.
The commission has warned the public to watch out for phishing and social engineering attempts in the wake of the disclosures — a standard risk when personal details such as names, phone numbers and tax identification numbers are in circulation. For now, the official picture is a partial one: 10 confirmed notifications, up to 20 claimed targets, and no public accounting yet of how many Filipinos' data was actually exposed.
