Claims posted on hacker forums between 5 and 7 November named 23 Philippine institutions as victims of cyberattacks, according to a tally by monitoring group Deep Web Konek. The claims cover 16 government agencies, four schools, two companies and one non-governmental organisation, but officials stress that most of the claims have not been verified, and the scale of any actual data loss remains unclear.

The reports were compiled by Deep Web Konek in a report published on 9 November, and were reported by Radar.ph and other Philippine outlets on 10 November. Eighteen of the 23 incidents were flagged on 5 November, a date associated with the annual Million Mask March, also known as Operation Vendetta, when hacking activity traditionally spikes.

Which institutions were named

Government agencies named in the reported incidents include the Presidential Commission on Good Government, the Department of Information and Communications Technology, the Department of Labor and Employment, the Office of the Vice President, the Department of Transportation, the Philippine Coast Guard, the Securities and Exchange Commission, the Department of the Interior and Local Government, the National Commission on Indigenous Peoples, the Philippine Rice Research Institute, the National Power Corporation, the Land Transportation Office and the Cybercrime Investigation and Coordinating Center.

The Philippine Air Force and the Bureau of Internal Revenue each recorded two separate hacking incidents over the three-day period. Schools named include Nueva Ecija University of Science and Technology, University of Camarines Norte, Cavite State University's General Trias campus and University of St. La Salle. The Philippine Red Cross, Mactan Electric Company and LBC Express were also named.

What the posts claim

According to The Philippine Star, a group calling itself DeathNote Hackers claimed to have posted about 10 GB of files from the Office of the Vice President and 19.2 million labour department records, while another group, Happy Go Lucky PH, said it held up to 19 million resident profiles from the DILG and the Barangay Central Database. Another outlet, Unbox.ph, put the combined total of data claimed across the incidents at more than 600 GB, while stressing that none of these figures has been confirmed.

Those numbers should be treated with caution. Claims posted on hacker forums are frequently exaggerated, and the groups behind them have an interest in overstating what they hold. No independent verification of the claimed file sizes or record counts has been published.

Two agencies confirm incidents

Two of the agencies named have confirmed incidents in separate statements. The Department of the Interior and Local Government confirmed on 10 November that its Local Government Unit Support System had been hacked, and said it was coordinating with the National Privacy Commission to address the incident. The DILG said it had received a report of a possible breach in LGUSS-BIMS, the system that holds the Records of Barangay Inhabitants, but has not said whether any data left the system.

The Securities and Exchange Commission confirmed a leak on 9 November, saying registered website users' personal information had been shared by hackers. It emailed users to warn that third-party threat actors may have entered its system through website users' devices.

The National Privacy Commission said it had received formal data breach notifications from six of the agencies in the Deep Web Konek report as of 10 November: the Presidential Commission on Good Government, the Department of Information and Communications Technology, the Department of Labor and Employment, the Bureau of Internal Revenue, the Securities and Exchange Commission and the Philippine Coast Guard. It also received notifications from the Philippine Amusement and Gaming Corporation, the Department of Trade and Industry, the Department of Justice and the Philippine Institute of Volcanology and Seismology, which were not in the Deep Web Konek report.

Officials: nothing verified yet

The Armed Forces of the Philippines said its Cyber Command and the service cyber units were checking whether the claims were credible. Spokeswoman Colonel Francel Margareth Padilla said a proper forensic investigation still had to be carried out, and the Air Force said there was nothing verified so far.

The National Privacy Commission has cautioned that reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the Data Privacy Act has been violated. Its advice to residents is to expect phishing, fraudulent messages and identity theft attempts, and to avoid suspicious links and attachments.

Under the commission's rules, institutions that handle personal information must notify it and affected data subjects within 72 hours of learning, or having reasonable grounds to believe, that a personal data breach has occurred.

Sources: Cyber Security ASEAN and Radar.ph.