PH government agencies bear brunt of Q3 data breaches— cybersecurity firm

MANILA – Philippine government agencies accounted for more than two-fifths of all data breaches in the country during the third quarter of 2026, according to a report by a regional cybersecurity firm. 

Viettel Cyber Security (VCS), which is part of the Vietnam-based Viettel Group, noted that the Philippines recorded 83 data breach incidents between July and September. This was up from 76 a year earlier, while exposed records jumped 63 percent to more than 85.9 million across 282 gigabytes of leaked data. 

In its Q3 Cybersecurity Landscape in the Philippines report, VCS said July was the worst month, accounting for 47 incidents and 60.2 million breached records, bringing the 2026 total to 338 incidents and over 421 million exposed records.

Public sector entities remained the primary target, representing 41 percent—or 34 incidents—of all third-quarter breaches, up from 30 percent in the first half of the year. VCS attributed the surge to a wave of credential leaks from agency portals in July alongside major intrusions into national agencies and local government units.

The company noted that a September breach hit the Land Transportation Franchising and Regulatory Board, leaking records covering transport operators, vehicle registries, and personnel.

The National Privacy Commission (NPC) earlier said that, as of Nov. 10, it has received personal data breach notifications from the following government agencies: 

• Presidential Commission on Good Government (PCGG); 
• Department of Information and Communications Technology (DICT); 
• Department of Labor and Employment (DOLE), through its Bureau of Local Employment; 
• Bureau of Internal Revenue (BIR); 
• Philippine Amusement and Gaming Corporation (PAGCOR); 
• Department of Justice (DOJ), through its Office for Alternative Dispute Resolution; 
• Securities and Exchange Commission (SEC); 
• Philippine Coast Guard (PCG); 
• Department of Trade and Industry (DTI); 
• Department of Science and Technology – Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)

VCS said behind many intrusions is an industrialized trade in stolen logins. Compromised credentials linked to Philippine users more than doubled year-on-year from 4.3 million to over 9.03 million in the third quarter, pushing the year-to-date total past 28.3 million—nearly triple the 9.74 million recorded across all of 2025, VCS said.

Driven by the “Stealer-as-a-Service” model, criminals rent information-stealing tools and trade stolen credentials on dark web forums and Telegram channels to fuel account takeovers, business email compromise, and ransomware attacks.

“Attackers today don’t need to break in when they can simply log in,” said VCS Country Manager Thomas Luu in a statement. 

“With more than 9 million Philippine credentials compromised in a single quarter, a stolen password has become one of the cheapest ways into a company’s network. The real question for business leaders is no longer whether their accounts have been exposed, but whether they would notice when someone else starts using them.”

In one notable government intrusion, a hacktivist group claimed to have remained inside an agency’s Active Directory for over a month before compromising a domain controller.

Outside the public sector, banking, financial services, and insurance firms ranked second among breached industries at 19 percent, driven by July attacks on six online lending platforms that exposed roughly 32 million records, followed by consumer services at 16 percent, VCS said.

Broader cyber threats also intensified, with phishing attacks climbing 43 percent year-on-year to 10,913 incidents—including 24 percent involving government impersonation aided by AI-generated deepfakes—while ransomware attacks nearly quadrupled from five to 19 across sectors led by transportation and manufacturing. 

“Cybercriminals are increasingly using AI-generated deepfakes to impersonate trusted authorities and make fraudulent schemes more convincing,” VCS said in its report.

VCS urged institutions to enforce phishing-resistant multi-factor authentication and strictly monitor privileged accounts.