Philippine Government Data Breach Claims Reach DOTr, SEC and BIR as the Privacy Commission Says No Agency Has Reported One

Forum posters added the Department of Transportation (DOTr), the Securities and Exchange Commission (SEC), the Bureau of Internal Revenue (BIR) and the Philippine Coast Guard to the list of agencies they say they have breached, a day after hackers claimed PhilJobNet, the Vice President's office and the Air Force. On 6 November the National Privacy Commission (NPC) said it had not received any personal data breach notifications from the agencies named. None of them has confirmed that the advertised data came from its systems.

The new claims

The monitoring group Deep Web Konek reported that files from the SEC and the BIR were shared on forums by a user calling themselves "sinigangmixwithgabi", Radar reports, without saying what those files contain.

The same poster says they hold the DOTr's HR data on about 4,534 employees: payroll entries, attendance logs, account records, biometric identifiers and copies of application source code, the Philippine News Agency reports in a story carried by SunStar. A group calling itself DeathNoteHackers, which made the PhilJobNet claim on 5 November, now says it has Coast Guard personnel information, rescue records, images and location data. Its screenshot shows about 1.35 GB across 6,698 files.

Radar also lists PAGCOR, whose National Database of Restricted Persons was uploaded by another user, and the interior department's local-government support system, claimed by HappyGoLuckyPH. Deep Web Konek's running total is 11 government agencies.

What the regulator said

Deputy Privacy Commissioner Jose Belarmino II, the NPC's spokesperson, cautioned that "reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred". The NPC "will coordinate directly with the government agencies identified in these reports" and will make them submit reports and meet their privacy obligations "where warranted".

It reminded agencies that NPC Circular No. 16-03 requires them to notify the commission and the people affected "within 72 hours" of learning of a notifiable breach.

The Million Mask March

BetterGov.PH, the civic tech group, noted that the claims surfaced on the day of the annual Million Mask March, but said no connection has been established.