Cybercrime watchdog identifies groups behind cyberattacks on BIR, SEC

MANILA — The Cybercrime Investigation and Coordinating Center (CICC) on Tuesday confirmed that the two groups that claimed responsibility for the recent data security incident involving the Bureau of Internal Revenue (BIR) and the Securities and Exchange Commission (SEC) were indeed behind the cyberattacks.

CICC Executive Director Renato Paraiso told ABS-CBN News that authorities are now working to establish the identities of the individuals behind the groups.

“Nandito na tayo sa process para tukuyin yung tunay na pagkakakilanlan ng mga taong ito at mapanagot sila sa ginawa nila, in violation of RA 10175 and possibly in violation of the Anti-Terror Law because critical information infrastructure yung mga tinarget nila,” said Paraiso.

For the BIR incident, the CICC is looking into the possible compromise of internal information, including employee data, credentials, and contracts of service.

Meanwhile, the CICC has just begun its investigation into the SEC incident.

The CICC is also looking into whether the data being circulated by the groups came from recent attacks or were information compromised in previous incidents and are now being presented as newly stolen data.

“Kung papansinin natin, most of these systems na hina-hack ng mga ito are yung mga open websites that are designed to be open,” said Paraiso.

Paraiso added that the groups behind the attacks are local actors.

He also said the CICC had not established a direct connection between the attacks and the Philippines’ hosting of ASEAN-related events.

“I think the goal has always been para mawalan ng tiwala ang mga taumbayan sa ating pamahalaan, i-disrupt ang services natin,” he said.

“Hindi naman ito bago, hindi naman ‘to dahil sa ASEAN lang. Ginawa na nila ito last year so nagkataon lang na ASEAN ngayon,” added Paraiso.

Paraiso stressed that while the CICC welcomes ethical hackers and cybersecurity communities who can help identify vulnerabilities in government systems, leaking data and disrupting public services are different matters.

“When you cross that line na ikakalat mo yung data na yan at aatakihin mo para i-disrupt yung services ng pamahalaan, na inaasahan ng ating mga kababayan, doon na pumapasok yung hindi ka na hacktivist. Kriminal ka na,” he warned.

As part of the government’s next steps, Paraiso said the CICC would also conduct cybersecurity posture assessments in the coming days to determine whether the affected government agencies complied with the National Cybersecurity Plan.

He said agencies are expected to strengthen their systems, including by establishing their own Security Operations Centers (SOCs) and National Computer Emergency Response Teams (NCERT) to protect their respective networks.

Meanwhile, the National Privacy Commission on Tuesday confirmed that it has received personal data breach notifications from several agencies as of Nov. 10, including the following:

Presidential Commission on Good Government (PCGG), Department of Information and Communications Technology (DICT), Department of Labor and Employment (DOLE), through its Bureau of Local Employment, Bureau of Internal Revenue (BIR), Philippine Amusement and Gaming Corporation (PAGCOR), Department of Justice (DOJ), through its Office for Alternative Dispute Resolution, Securities and Exchange Commission (SEC), Philippine Coast Guard (PCG), Department of Trade and Industry (DTI), Department of Science and Technology – Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)

The NPC said the notification is crucial to assess and determine the appropriate regulatory response.

“Each notification received by the NPC is reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident, its potential impact on affected individuals, and the measures undertaken by the agency concerned,” NPC Deputy Privacy Commissioner and Spokesperson Atty. Jose S. Belarmino II said.

Assessments are reviewed by the NPC’s Compliance and Monitoring Division before an appropriate action or decision is released.

He added that agencies must take “appropriate and timely measures” to address these incidents, mitigate potential harm to affected individuals, notify affected subjects and to strengthen safeguards against similar incidents.

The NPC said updates will be provided as appropriate.