The Philippines faced a sharper wave of cyberattacks in the third quarter of 2026, with data breaches hitting government agencies, banks and consumer services, according to a new report from Viettel Cyber Security (VCS). The firm recorded 83 data breach incidents between July and September, up from 76 in the same period last year, exposing 85.9 million records — a rise of 63 per cent year on year.

Taken together with the first half of the year, the Philippines has now recorded 338 cyber incidents in 2026 so far, with more than 421 million records breached. VCS, which based its findings on its Viettel Threat Intelligence monitoring platform, warned that the risk of systemic intrusion remains high as attackers focus on fewer but larger datasets and on selling direct access to corporate networks.

Government hit hardest

Government bodies were the most targeted, accounting for 34 incidents, or 41 per cent of the quarterly total. VCS linked the trend to credential leaks from agency portals and intrusions into national agencies and local government units. The banking, financial services and insurance sector followed with 16 incidents, or 19 per cent, affecting lending platforms, banks and investment firms, while consumer services recorded 13 incidents, or 16 per cent, involving hotel groups and online gaming platforms.

The largest single exposures were concentrated in a small number of incidents. Six online lending platforms suffered breaches involving about 32 million records, while an incident in the transport sector exposed 16 million records. Separate attacks on public institutions and healthcare facilities compromised identity documents and internal systems, including hospital data covering more than 3.5 million files.

Credential theft becomes industrialised

Behind the breaches sits a fast-growing trade in stolen logins. VCS recorded more than 9 million compromised credentials in the quarter, more than double the 4.3 million seen a year earlier, taking the year-to-date total past 28.3 million — already almost three times the figure for the whole of 2025.

“Credential theft is no longer driven by isolated spikes; it has become a continuous, industrialised supply that feeds the underground market and fuels targeted intrusions,” VCS said. The firm warned that attackers are increasingly turning stolen identities into long-term network access, so that compromising a single central account can let them move freely through connected systems, steal data and even take control of critical infrastructure.

Thomas Luu, country manager of VCS, put the danger bluntly: “Attackers today don’t need to break in when they can simply log in. With more than 9 million Philippine credentials compromised in a single quarter, a stolen password has become one of the cheapest ways into a company’s network.”

Phishing and AI-driven scams surge

Phishing attacks detected by the firm rose 43 per cent year on year to 10,913 in the quarter. Most involved government impersonation, romance scams, fraudulent fund-recovery services, cross-border card fraud and phishing through social media, SMS and messaging platforms. The financial sector was the main target, accounting for 29 per cent of incidents over the first nine months of the year, while government spoofing made up 24 per cent of threats and social media threats 16 per cent.

Criminals are also leaning harder on artificial intelligence. VCS said attackers used AI-generated deepfake images and videos to impersonate foreign public figures and national cybercrime authorities, and combined fake government social media accounts with SMS campaigns using IMSI-catcher devices and recruitment through Facebook and Telegram to funnel victims into offshore scam compounds.

Ransomware nearly quadruples

Ransomware remained a serious threat, with 19 incidents recorded in the quarter, up from five in the same period of 2025 and 13 in the previous quarter. Transport and logistics recorded the highest number of incidents. VCS said the campaigns continued to use the double-extortion model, in which data is stolen before systems are encrypted and then used as leverage against victims, with larger enterprises facing higher risks because of the scale and complexity of their systems.

What businesses should do

VCS urged Philippine organisations to take a more proactive approach, including stronger account protection, continuous threat monitoring, timely software updates, regular data backups, better incident response and checks on third-party security risks, alongside employee awareness training. “What we often see on the ground is that organisations only discover an attack after the damage is done,” Mr Luu said. “Going into 2027, the businesses that stay ahead will be those that treat cybersecurity as a leadership priority reviewed regularly, not an IT problem fixed after an incident.”

The firm expects threats to keep rising, with hacktivist attacks growing in frequency and sophistication, moving from simple website defacement towards long-term network intrusion, data theft and timed public leaks. It also warned that fake or exaggerated breach claims on dark web forums will keep spreading, forcing organisations to confirm real incidents quickly to limit reputational damage.