Philippine migrant-worker databases (POEA, now DMW): 27 SQL Server backups (68.8 GiB) copied out
Severity: high · Patch status: no-fix-needed · Since 2026-10-28
Hunt.io reported on 28 October 2026 that an open directory on a Singapore UpCloud-hosted server exposed a transfer log for 27 Microsoft SQL Server backup files (68.837 GiB, about 73.9 GB decimal), copied on 6 September 2026 and completed in 23 minutes 46 seconds. The filenames (POEAEServices, OFW, eContracts, Cashier, LandBank and others) point to the Philippine Overseas Employment Administration, whose functions were folded into the Department of Migrant Workers under Republic Act 11641. Hunt.io calls this a filename-based assessment and says it did not open the backups, so the contents and any personal data are not established. The server held a rebranded GodPotato binary and a full Impacket environment, but Hunt.io observed no tool in use and could not establish initial access, execution, or where the data went. The National Privacy Commission said on 29 October that it is investigating and coordinating with the DMW. Neither the DMW nor the DICT had publicly confirmed the scope, and the sources report no sale or public leak. Recommended actions are reducing exposure of SMB and WinRM, hardening against SeImpersonate-style privilege escalation, hunting for the staged artefacts, and treating this as a breach until the data is examined.
What to do
- Scan networks for exposure of SMB (445) and WinRM (5985/47001) and lock down the external attack surface
- Restrict over-privileged accounts and services vulnerable to SeImpersonate/GodPotato-style privilege escalation
- Harden and monitor SQL Server backup storage and egress; alert on bulk backup transfers
- Assume breach until the backup contents are examined; monitor for fraud or identity-theft misuse of migrant-worker records and prepare notifications
- Hunt for Impacket and GodPotato artefacts, including the staged Wrqsnx.dll and Wrqsnx_portal.dll named by Hunt.io
Sources
All live incidents on Threat Watch
