There have been notable cases of data breaches involving both private and government entities in the Philippines. Here is our list of these cases in recent years.
Hacking of private and public websites in 2024
The National Bureau of Investigation (NBI) on June 21, 2024, arrested three individuals for the alleged hacking of both government and private institutions, banks, and Facebook accounts.
The suspects, whose faces were covered, were identified through aliases ‘kangkong’, ‘Mirasol’, ‘Sibat’, ‘Ricardo Redoble’, and ‘lulu’, and were involved in multiple unauthorized access attempts and breaches of private and government websites since 2016.
One of the suspects, alias “kangkong” reportedly admitted to hacking 93 websites. All suspects are members of two big hacking groups, Philippine Lulzec and Globalsec, authorities said.
Alias “kangkong” is also reportedly a data officer of the media giant Manila Bulletin. The news sent shockwaves, after “kangkong” pointed to Arturo Samaniego, the technology editor of the paper as the one ordering the hacking. The National Bureau of Investigation is said to be preparing cases against the suspects.
Jollibee data breach affects 11 million in 2024
The government’s National Privacy Commission (NPC) confirmed that a data breach at fast-food giant Jollibee Group affected 11 million data subjects in late June, involving sensitive personal information, including customers’ dates of birth and Senior Citizen ID numbers.
In a statement, the NPC said the breach involved “unauthorized access to Jollibee Group’s data lake, which holds data for all companies in the group.”
‘Medusa’ attacks PhilHealth in 2023
The recent attack on the Philippine Health Insurance Corporation (PhilHealth) has far-reaching implications for the government’s cybersecurity capabilities. As of October 10, hackers have begun releasing stolen data on the dark web, including confidential memos and member data (i.e., addresses, phone numbers, and insurance IDs). They demanded $300,000 (P17 million) in exchange for the stolen information.
The hacker group, which the government calls Medusa, accessed the data on September 22 after restricting PhilHealth staff from accessing their system. The insurance corporation shut it to prevent further damage, but the hackers had already secured 734 GB of files. PhilHealth has 59 million direct and indirect contributions. The government immediately implemented security measures. It also refused to pay the ransom. Instead, it focuses on reinforcing cybersecurity via audits and other security measures.
UCPB Independence Day online banking scheme in 2020
Reports said the government-controlled United Coconut Planters Bank (UCPB) lost millions of pesos through numerous online transfers and automated teller machine (ATM) withdrawals during the three-day holiday in June 2020. In one case, the culprits made 57 withdrawals from a single ATM, taking out its entire ₱4 million stock. The total losses amounted to ₱167 million.
A bank official reported that the hackers held UCPB accounts, which they used with other local banks to transfer and withdraw the money. Based on theories, the culprits might have had inside help and could be a part of a larger syndicate operating in the local banking system. Thankfully, the funds of account holders remain safe, with UCPB vowing to improve its cybersecurity infrastructure.
2019 data breach on Cebuana Lhuillier’s email servers
In 2019, pawnshop and remittance firm company Cebuana Lhuillier reported a data breach involving its email servers for its marketing activities, compromising the data of roughly 900,000 clients, which is 3% of its total clientele. The company also traced unauthorized downloads dating back to August 2018.
In its official statement, Cebuana Lhuillier revealed that the data dump included customer birthdays, addresses, and sources of income. Fortunately, financial transaction details were safe from the attack. The company collaborated with the NPC to perform an internal investigation and improve its cybersecurity following the incident.
Wendy’s Philippines gets hacked in 2017
In 2017, the website of fast-food chain Wendy’s Philippines was reportedly hacked and over 82,000 customer and employee records, including names, email addresses, postal addresses, and resumes, were affected. In response, the NPC obliged the company to notify those affected and ordered the company to perform a security assessment.
Comelec data breach involving 70 million in 2016
In 2016, the Commission on Elections (Comelec) reported a data breach which affected 70 million a month before the national elections.
The breach reportedly involved fingerprint data; passport information; email addresses; postal addresses; birthplace; height and weight; gender; marital status; and parents’ names.
PhilHealth photo from Philippine News Agency.
READ MORE TECH NEWS.
