SEC Philippines Data Leak: Regulator Tells Portal Users Their TINs and Contact Details Were Exposed

The Philippine Securities and Exchange Commission (SEC) has told registered users of its online portals that their full names, usernames, email addresses, mobile numbers, dates of birth, genders, addresses and Tax Identification Numbers were exposed. Notices went to affected account holders on 9 November. The SEC hasn't said how many people that is.

The SEC was one of the agencies named on 6 November, when files said to come from the SEC and the BIR were circulating on forums and the National Privacy Commission (NPC) said it had not received formal notification from any of them.

What the SEC says happened

Its advisory on X says the commission became aware on 6 November of reports posted online about data claimed to be associated with it. The SEC's notices, as BitPinas reports them, place the likely origin on users' side: malware infections or unauthorised third-party access targeting the devices people used to log in. The commission says the passwords stored in its databases were not leaked, corporate filings were untouched and no system data was altered or destroyed.

That account is preliminary. Investigators are still verifying the origin, scope and validity of the dataset. The SEC's advisory doesn't name a forum or poster, though the files circulating on 6 November were shared by a user calling themselves "sinigangmixwithgabi", according to monitoring group Deep Web Konek.

Regulators and the BIR

The SEC has reported the incident to the NPC. Under NPC Circular 16-03, agencies must notify the commission and the people affected within 72 hours of learning of a notifiable breach. The NPC hasn't commented on the SEC's report.

The BIR, also named in the forum posts, has opened its own investigation with DICT, CICC and the police cybercrime unit but hasn't confirmed anything.

What affected users are told to do

The SEC asks users to change passwords on any service that shares the same credentials, turn on multi-factor authentication, scan their devices and watch their accounts for fraudulent messages or unauthorised transactions. The commission says it does not ask for passwords or security PINs. Questions go to the commission's Data Protection Officer, Oliver V. Chato.