MANILA, Philippines — The Philippines data breaches under investigation have raised concerns about the security of government databases after at least 10 agencies and institutions reported incidents to the National Privacy Commission (NPC), while authorities examine wider claims involving 23 government, private and educational institutions.
The reported incidents have renewed concerns about the possible exposure of sensitive personal information belonging to Filipinos, as cybersecurity investigators work to establish the extent of the alleged attacks.The NPC confirmed receiving breach notifications from 10 government agencies and institutions following reports of alleged cyberattacks and data leaks that surfaced between November 5 and 7, 2026.
Meanwhile, the Cybercrime Investigation and Coordinating Center (CICC) is examining claims involving approximately 20 government agencies, including allegations that hackers obtained and published information from government systems.
Authorities are also checking whether some of the datasets circulating online are newly stolen information or previously exposed records being republished to create the appearance of fresh cyberattacks.
NPC Confirms Breach Notifications From 10 Government Institutions
According to reports, the following government agencies and institutions submitted breach notifications to the National Privacy Commission (NPC) amid investigations into the reported cybersecurity incidents:
- Bureau of Internal Revenue (BIR)
- Securities and Exchange Commission (SEC)
- Department of Information and Communications Technology (DICT)
- Presidential Commission on Good Government (PCGG)
- Department of Labor and Employment (DOLE)
- Philippine Amusement and Gaming Corporation (PAGCOR)
- Department of Justice (DOJ)
- Philippine Coast Guard (PCG)
- Department of Trade and Industry (DTI)
- DOST–Philippine Institute of Volcanology and Seismology (PHIVOLCS)
The notifications indicate that the reported incidents have moved beyond online allegations and are now subject to formal privacy and cybersecurity investigations.
However, a breach notification does not necessarily mean that every allegation circulating online has been independently verified or that all information within an agency’s systems was compromised.
The NPC has also reminded government agencies that they remain responsible for protecting personal information, including when their information technology infrastructure or services are managed by third-party providers.
BIR and SEC Investigate Possible Exposure of Personal Information
Two of the most prominent institutions mentioned in the reports are the Bureau of Internal Revenue and the Securities and Exchange Commission.
The BIR acknowledged investigating a security incident involving the possible exposure of certain taxpayer profile information.
Based on its initial findings, the agency said its filing and payment records were not compromised. It also reported no modification or loss of taxpayer information.
The SEC likewise reported a security incident that may have exposed individual profile information.
The commission said its initial findings indicated that its central database and internal systems remained intact. It also reported that passwords were not leaked and company records were not affected.
The SEC advised users to change their passwords and activate two-factor authentication as precautionary measures.
Both agencies have faced questions about the security of information entrusted to government institutions, particularly records containing personal and financial details.
CICC Investigates Claims Involving Around 20 Government Agencies
In a November 12 update, CICC Executive Director Renato Paraiso said authorities were examining hacking allegations involving approximately 20 government agencies.
Investigators are also checking the authenticity and origin of the information being circulated online.
One concern is the possible recycling of previously leaked datasets. In some cases, cybercriminals may republish old information and present it as evidence of a newly successful cyberattack.
This makes independent forensic examination necessary before authorities can determine the actual number of affected institutions and the extent of any unauthorized access.
The CICC has also reported that vulnerabilities associated with the BIR and SEC incidents had been contained and addressed, while investigations continued to identify those responsible.
The findings are expected to help establish whether the reported incidents involved new intrusions, previously exposed information or a combination of different cybersecurity problems.
Alleged Data Exposure Extends Beyond Government Agencies
The initial reports from cybersecurity monitoring group Deep Web Konek identified 23 institutions allegedly affected by cyberattacks or data exposure incidents.
These reportedly included government agencies, educational institutions, private companies and a nongovernment organization.
Among the private organizations mentioned was LBC Express, where hackers allegedly claimed to have obtained millions of shipment-related records.
Educational institutions, including Cavite State University–General Trias Campus, Nueva Ecija University of Science and Technology, University of Camarines Norte and University of St. La Salle, were also included in the reported incidents.
The monitoring group’s findings also raised concerns about alleged exposure involving the Office of the Vice President and local government-related information systems.
However, the reported incidents have varying levels of verification. The inclusion of an institution in a cybersecurity monitoring report should not automatically be interpreted as confirmation that its entire database was successfully stolen.
Authorities still need to establish the authenticity, scope and source of the information involved in each case.
Facebook
Twitter