NPC confirms data breaches in 10 gov’t agencies; warns public against phishing

MANILA — The National Privacy Commission (NPC) confirmed that it has received personal data breach notifications from ten government agencies of as Tuesday, November 10.

These include the following:


• Presidential Commission on Good Government (PCGG)

• Department of Information and Communications Technology (DICT)

• Department of Labor and Employment (DOLE), through its Bureau of Local Employment

• Bureau of Internal Revenue (BIR)

• Philippine Amusement and Gaming Corporation (PAGCOR)

• Department of Justice (DOJ), through its Office for Alternative Dispute Resolution

• Securities and Exchange Commission (SEC)

• Philippine Coast Guard (PCG)

• Department of Trade and Industry (DTI)


• Department of Science and Technology–Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)

The NPC said agencies have 72 hours upon discovering a personal data breach to notify both the regulator and the affected individuals.

“Each notification received by the NPC is reviewed and assessed by our Compliance and Monitoring Division, which examines the nature and circumstances of the reported incident, its potential impact on affected individuals, and the measures undertaken by the agency concerned,” NPC Deputy Privacy Commissioner and Spokesperson Atty. Jose S. Belarmino II said.

Belarmino said the NPC will then look into possible lapses or negligence on the part of the agencies that may have led to the breaches.

“Pupwedeng patawan sila ng administrative fine. At bukod doon, meron yang kulong at pagpataw ng danyos o damages kung mapatunayan na meron silang criminal violation na ginawa sa ilalim ng batas,” he said.

“Kahit meron silang third party processor, ang tinitignan pa rin natin, ang controller. In this case, yung government agency,” he added.

In light of the reported data breaches, Belarmino urged the public to be more cautious about suspicious messages, links, and other attempts to obtain personal information.

He warned that compromised personal or sensitive information could be used to access people’s accounts, steal money, or obtain other benefits through fraudulent means.

“Yung implications, hindi lamang sa digital na space, pwede rin sa physical na mga krimen na nangyayari. Dahil alam kung saan kayo nakatira, possible pwede kang i-target, puntahan doon, tingnan kung may tao ba doon,” he added.

Belarmino reminded the public not to click links sent through text messages, even if these appear to come from government agencies or banks.

He also advised people to verify the legitimacy of emails and other communications before responding.