Cyberattack Claims Hit 23 Philippine Institutions; DILG Checks a Possible Barangay Data Breach

Cyberattack claims posted on hacker forums between 5 and 7 November name 23 Philippine institutions: 16 government agencies, four schools, two companies and one NGO, according to a tally by the monitoring group Deep Web Konek that Radar.ph and The Philippine Star reported. On 10 November the Department of the Interior and Local Government (DILG) said it was verifying a possible data breach in its barangay records system.

Ten agencies, the Bureau of Internal Revenue (BIR) and the Securities and Exchange Commission among them, have filed breach notifications with the National Privacy Commission, which hasn't said whether the incidents are connected.

What the posts claim

Radar counts 18 of the 23 incidents flagged on 5 November. According to the Star, a group called DeathNote Hackers posted about 10GB of Office of the Vice President files and 19.2 million labour department records, while Happy Go Lucky PH says it holds up to 19 million resident profiles from the DILG and the Barangay Central Database. Unbox.ph, which puts the combined total at over 600GB, stresses that none of these numbers is confirmed.

The DILG barangay system

The DILG says it received a report of a possible breach in LGUSS-BIMS, the system that holds the Records of Barangay Inhabitants. It has contacted the National Privacy Commission but hasn't said whether any data left the system.

The military's position

AFP spokesperson Col. Francel Margareth Padilla said Cyber Command and the service cyber units are checking whether the claims are credible: "We still have to conduct a proper forensic investigation". The Air Force says there is "nothing verified" so far.

What residents are told

The privacy commission's advice is to expect phishing, fraudulent messages and identity theft attempts, and to avoid suspicious links and attachments.