Data Breach Notices From 10 Philippine Agencies, BIR and SEC Among Them, Reach the Privacy Commission

Ten Philippine government agencies have formally notified the National Privacy Commission (NPC) of personal data breaches, the commission said on 10 November. Newsbytes lists them as the Bureau of Internal Revenue (BIR), the Securities and Exchange Commission (SEC), the ICT department, PCGG and Pagcor, plus the labour department's Bureau of Local Employment, the justice department's Office for Alternative Dispute Resolution, the Coast Guard, the trade department and Phivolcs. The NPC did not disclose how many people may be affected, what data was involved or whether the incidents are connected.

Four days earlier the commission had said no agency named in that week's forum leak posts had reported a breach. The BIR is on the list while a hacker group claims records of more than 10 million taxpayers. Its latest advisory, on 9 November, said only that it was investigating with the CICC and DICT.

What happens to the notifications

The commission's Compliance and Monitoring Division is reviewing each reported incident for its nature, likely impact and the corrective steps taken, as NPC Circular 16-03 provides. Its findings go to the Commission En Banc, which decides any action. The Daily Tribune notes that the NPC "has not announced any sanctions against the SEC", which has already told portal users their tax ID numbers were exposed.

Deputy Privacy Commissioner Jose Belarmino II said that "breach notification is only one part of an agency's responsibility under the Data Privacy Act". Agencies also stay answerable for data handed to contractors: under Section 21 of Republic Act 10173, outsourcing doesn't remove the duty to keep it safe.

Blackmail claims and the NBI

Before any notification was filed, forum posts tracked by the monitoring group Deep Web Konek claimed data from several of these agencies, credited to groups including "DeathNote Hackers (DNH)" and "HappyGoLuckyPH". The NPC hasn't tied any notification to those claims.

The Cybercrime Investigation and Coordinating Center (CICC) has asked the National Bureau of Investigation (NBI) for help. Its executive director, Renato Paraiso, told Bilyonaryo that "certain individuals or hackers" will be summoned and apprehended by the NBI, and that the government won't tolerate attempts to "pressure or blackmail its agencies". No arrest has been announced.

Paraiso's first assessment, which gave no numbers, found many incidents involved "old exploits and previously exposed information".

What the public is told to do

The NPC warns of phishing, fraudulent messages, identity theft and other social engineering schemes that exploit worry about the breaches. It asks people to avoid suspicious links and attachments, take care before answering unsolicited messages and not share personal information with anyone they can't verify. The BIR asks taxpayers to transact only through its official channels and platforms.