Data breach alert: NPC warns Filipinos as 10 gov’t agencies report cyber incidents

National

FILIPINOS are being urged to tighten their digital security, watch out for phishing attempts and avoid suspicious messages as a wave of reported cybersecurity incidents involving government agencies and other local institutions raises concerns over possible data exposure.

The National Privacy Commission (NPC) is evaluating breach notifications submitted by at least 10 government agencies and public institutions following the incidents.

The agencies include the Department of Information and Communications Technology (DICT), Presidential Commission on Good Government, Bureau of Local Employment, Bureau of Internal Revenue (BIR), Philippine Amusement and Gaming Corp., Department of Justice’s Office for Alternative Dispute Resolution, Securities and Exchange Commission, Philippine Coast Guard, Department of Trade and Industry, and Department of Science and Technology-Philippine Institute of Volcanology and Seismology.

NPC Deputy Privacy Commissioner and spokesperson Jose Belarmino II said the commission’s Compliance and Monitoring Division is assessing the submissions and will recommend appropriate regulatory action.

Under NPC Circular No. 16-03, breach reporting is mandatory when prescribed conditions are met, but filing a notification does not automatically absolve an agency of liability under the Data Privacy Act of 2012.

“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act. Equally important is how the agency responds to the incident, protects the individuals who may be affected and addresses the vulnerabilities that may have contributed to the breach,” Belarmino said in a Philstar report.

The NPC also stressed that government agencies remain accountable for personal information under their custody even when they outsource data processing or IT services to contractors. Affected individuals must be notified within prescribed timelines when mandatory reporting conditions apply.

The advisory follows a report by cybersecurity monitoring group Deep Web Konek identifying alleged breaches involving as many as 23 local institutions. Its assessment, covering Nov. 5 to 7, cited millions of exposed personal, corporate and administrative records.

Among those named were government agencies, military and law enforcement units, public utilities, logistics firms and educational institutions. LBC Express allegedly suffered a compromise involving 20.9 million customer shipment logs. Reported data categories included government IDs, taxpayer details, employee records, payroll information and student files.

Separately, the BIR confirmed that certain taxpayer profile information may have been exposed in incidents reported on Nov. 6 and 7, but said initial findings showed filing and payment records remained uncompromised.

The agency is conducting a forensic investigation with the Cybercrime Investigation and Coordinating Center and the DICT-National Computer Emergency Response Team to determine the extent and source of unauthorized access.

“The BIR recognizes the concerns arising from these incidents and assures the public it is taking measures to protect taxpayer information. To fully address system vulnerability, the BIR is strengthening access controls and testing all remediation measures,” it said.

The BIR advised taxpayers to update account credentials, enable multi-factor authentication, monitor account activity and conduct transactions only through official channels.(MyTVCebu)