Philippine NPC receives breach notifications from 10 government agencies incl. BIR, DICT, SEC
Severity: medium · Patch status: no-fix-needed · Since 2026-11-10
On 10 November 2026 the Philippine National Privacy Commission said it had received personal data breach notifications from 10 government bodies: the Bureau of Internal Revenue, the Securities and Exchange Commission, the Department of Information and Communications Technology, the Presidential Commission on Good Government, the DOLE's Bureau of Local Employment, PAGCOR, the DOJ's Office for Alternative Dispute Resolution, the Philippine Coast Guard, the Department of Trade and Industry, and DOST's PHIVOLCS. The notifications are being assessed under the Data Privacy Act of 2012 and NPC Circular 16-03, and the NPC says filing a notice does not excuse agencies from fixing their security. The NPC has not disclosed the data types, the number of people affected, the attack vectors, the dates, or whether the incidents are connected, and it names no threat actor. This follows a wave of alleged leaks and website defacements on 5-7 November, which the NPC said on 6 November it was verifying, when it had not yet received any notifications. Public detail is thin: the SEC said on 9 November that an incident detected on 6 November may have exposed individual profile information of registered website users, with no evidence that company records or passwords were compromised; the BIR is investigating allegations that data associated with it leaked and has not established whether its systems were breached. The NPC warned of phishing and identity theft that could exploit public concern.
What to do
- Monitor NPC advisories for affected agencies, data types and affected individuals; the NPC is still assessing each notification
- Assume citizen data held by Philippine agencies may be exposed and watch for phishing using tax, SEC or agency details
- Enable MFA and monitor accounts tied to BIR, SEC, or DICT services
- Review any data-sharing with the affected agencies
Sources
All live incidents on Threat Watch
