The National Privacy Commission (NPC) is investigating reports of possible data leaks involving government agencies, including the Department of Transportation (DOTr) and the Philippine Coast Guard (PCG), following claims that sensitive personnel and operational records were obtained by hackers.
In a statement Friday, NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II said the commission is coordinating directly with the agencies mentioned in the reports to determine whether personal information was compromised.
The NPC clarified that it had not received any official personal data breach notifications concerning the reported incidents as of Friday.
The investigation follows claims posted on an underground cybercrime forum Thursday by an individual using the alias “sinigangmixwithgabi.”
The unidentified threat actor claimed to have obtained information from the DOTr’s Human Resource Information System, allegedly involving approximately 4,534 employees.
The purported dataset reportedly includes personnel records, payroll information, attendance logs, account details, biometric identifiers and copies of application source code.
In a separate incident, a hacking group identifying itself as DeathNoteHackers claimed to possess information allegedly associated with the Philippine Coast Guard.
The group claimed the files contained personnel information, rescue records, photographs and location data.
A screenshot showing the alleged folder properties indicated approximately 1.35 gigabytes of information, comprising 6,698 files and 3,411 folders.
Both claims were documented by Deep Web Konek, a Philippine-based civilian cybersecurity advocacy group.
However, the authenticity of the alleged leaked information has not been independently verified, and neither government agency has confirmed that the advertised data originated from its systems.
NPC: Alleged leaks do not automatically establish a breach
The privacy commission emphasized that online claims of unauthorized access or data exposure do not necessarily prove that a personal data breach occurred.
“Reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the provisions of the Data Privacy Act of 2012 have been violated,” the NPC said.
The commission explained that determining whether a breach occurred requires a thorough examination of the circumstances, including the nature of the information involved and whether personal data were actually compromised.
The NPC said it would coordinate with the concerned agencies to verify the reports and establish whether further investigation or regulatory intervention is necessary.
If warranted, the commission may require the agencies to submit incident reports and comply with their responsibilities under Republic Act No. 10173, or the Data Privacy Act of 2012.
Agencies reminded of 72-hour notification rule
Under NPC Circular No. 16-03, personal information controllers must notify the commission and affected individuals within 72 hours upon knowledge of, or reasonable belief that, a personal data breach requiring mandatory notification has occurred.
The requirement is intended to ensure timely reporting and allow appropriate measures to protect individuals whose personal information may have been exposed.
The NPC reiterated that government agencies and other organizations handling personal data must comply with applicable privacy and security regulations.
The commission said it would continue monitoring developments and take appropriate regulatory action if the reported incidents are confirmed to involve violations of data privacy laws.
For now, the NPC stressed that the allegations remain unverified and that further assessment is necessary before determining whether any personal data breach occurred.
