Philippines Data Breaches in Q3 2026: 83 Incidents Exposed 85.9 Million Records, Viettel Cyber Security Report Says

Data breaches in the Philippines exposed 85.9 million records in 83 incidents between July and September, according to Viettel Cyber Security's (VCS) threat landscape report for the third quarter of 2026. The same report counts more than 9 million compromised credentials linked to Philippine users in the quarter, up from 4.3 million in Q3 2025. It lands in the same week the National Privacy Commission is reviewing breach notices from 10 agencies, the BIR and SEC among them.

Where the records came from

The Daily Tribune's account of the report puts the biggest single share with lenders: six online lending platforms, with about 32 million records. One transport-sector incident exposed 16 million records, and the exposed material also included hospital data covering more than 3.5 million files.

Philstar reports that VCS still names government agencies as the main target of attacks. It says one unnamed agency's leak ran to 103.2 GB, including over 140,000 scanned passports and IDs, and that July alone saw 47 incidents and about 60.2 million records. The year-to-date total stands at 338 incidents and over 421 million records.

Phishing, stolen logins and ransomware

VCS logged 10,913 phishing attacks, up 43% year on year. Banks, financial services and insurers drew 29% of recorded attacks. Among the lures, government impersonation made up 24%, and social media lures 16%.

This year's count of compromised logins has passed 28.3 million, nearly three times the 2025 total, and ransomware incidents went from five in Q3 2025 to 19. VCS country manager Thomas Luu's reading: "Attackers today don't need to break in when they can simply log in."

Old data in new claims

Hackers now claim attacks on around 20 government agencies, twice the number that have filed breach notices. Renato Paraiso, executive director of the Cybercrime Investigation and Coordinating Center (CICC), says part of what they post is recycled. Of the government datasets, he told radio station dzBB: "We have already seen evidence that these datasets are data from past exploits." The CICC is working with the National Bureau of Investigation to identify the groups behind the claims, among them one calling itself the "Three Musketeers", which allegedly targeted the Bureau of Internal Revenue.