The Philippines Securities and Exchange Commission (SEC) has confirmed a data breach affecting users of its online platforms, sending direct notifications to affected account holders on Monday, 9 November. The exposed information reportedly includes full names, usernames, email addresses, mobile numbers, dates of birth, genders, physical addresses and Tax Identification Numbers.

The regulator said an internal assessment determined that passwords stored in its databases were not leaked, corporate filings were unaffected and system data was neither altered nor destroyed. It said the leak may have originated from malware infections or unauthorized third-party access targeting individual devices used to log into its online portals.

From allegation to confirmation in three days

The sequence unfolded quickly. The SEC became aware of online reports of an alleged leak on 6 November and issued a public advisory announcing an investigation on 7 November. By 9 November, direct notifications to affected users had gone out, and the commission had formally reported the incident to the National Privacy Commission.

The commission advised affected users to change passwords across any services sharing the same credentials, enable multifactor authentication, run security scans on their personal devices and monitor accounts for fraudulent communications. It directed inquiries to its Data Protection Officer, Oliver V. Chato, at its Makati City headquarters.