The Securities and Exchange Commission (SEC) of the Philippines has confirmed a data security incident after a forum listing claimed to offer about 487,000 lines of data linked to the regulator.

The SEC said it detected the incident on 6 November and is carrying out a system-wide security audit of its digital platforms and databases. In a statement issued on 9 November, the regulator said its initial findings showed no company records had been affected, no passwords had been leaked and no data had been modified or altered. It added, however, that some personal information may have been exposed.

487,000-line listing appeared days earlier

The incident came to public attention after a forum user operating under the alias "sinigangmixwithgabi" published a listing titled "Philippines Securities and Exchange Commission data 487K Lines" on 5 November, according to cybersecurity monitoring group Deep Web Konek. The post allegedly offered a dataset of about 487,000 lines of information linked to the SEC, along with a download link.

The authenticity of the dataset, the number of people potentially affected and the extent of any unauthorised access have yet to be independently established. The SEC has not confirmed whether the dataset circulating online is connected to the incident it detected, and it has not identified the systems involved.

What may have been exposed

The SEC said the personal data that may have been exposed includes individual profile information. Reporting on the regulator's advisory said the categories included names, usernames, contact details, birth dates, addresses and taxpayer identification numbers. The commission said it was still verifying the origin, scope and validity of the affected records.

The SEC formally notified the National Privacy Commission on 9 November, in line with mandatory breach reporting rules. It said it had reinforced access controls, updated authentication credentials and added monitoring rules, and advised users of its online platforms to change passwords reused across accounts, enable multifactor authentication and stay alert to phishing messages. The investigation remains ongoing.