Philippine Privacy Commission Probes Theft of 27 OFW Database Backups Linked to DMW Systems

The Philippines' National Privacy Commission (NPC) is investigating the suspected theft of database backups from systems that serve overseas Filipino workers (OFWs). Threat intelligence firm Hunt.io found an attacker's log recording a "68.837 GiB copy of 27 SQL Server backups", made in under 24 minutes on 6 September, with file names pointing to the Department of Migrant Workers (DMW). What the backups contain, and how many people are in them, isn't known.

How it surfaced

The evidence came from the attacker's side. The attacker ran a staging host at UpCloud in Singapore and left its working folder open to anyone through an unauthenticated web directory on port 80. Hunt.io's crawler indexed it on 7 September; the firm published its report on 28 October and says it notified the relevant national CERT beforehand.

Hunt.io doesn't have the stolen data and hasn't opened the backups. It read the logs and reverse-engineered the tools left in the folder, it told Rappler.

Which systems

The backup files are named POEA_EServices, POEA_HelpDesk, OFW and OfwDB, with others for accreditation, repatriation, eContracts and the cashier. Hunt.io matches some to the Balik-Manggagawa online processing system and the OFW Welfare Monitoring System. The Philippine Overseas Employment Administration (POEA) has since been folded into the DMW.

Two addresses that downloaded the attacker's tools present a certificate for *.dmw.gov.ph issued to the POEA, which Hunt.io says establishes them as "the agency's own portal hosts". Hunt.io calls its mapping "a filename-based contextual assessment", not a confirmed identification, and doesn't attribute the theft to any known group.

Its report puts the population those systems cover at 2.16 million, "not a count of the records in these backups". It also leaves open how the operator entered the agency network and where the copied data was sent.

What the regulator and the agency say

The NPC said on 29 October it is investigating to determine "whether any violations of the Data Privacy Act (DPA) of 2012 have occurred" and is coordinating with the DMW. It hasn't said how many individuals, if any, may have been affected.

The DMW hasn't publicly confirmed the full extent of the suspected breach.

In early September a hacktivist group calling itself HappyGoLuckyPH claimed it had defaced the DMW website and had access to the agency's Active Directory, and the Department of Information and Communications Technology (DICT) said its emergency response team had detected unauthorised access to the site. Hunt.io's report doesn't mention the group, and no source has linked the two.