NPC Investigates Alleged Data Breaches Across Multiple Philippine Government Agencies

The National Privacy Commission (NPC) is currently evaluating breach notifications from at least 10 government agencies, following a series of cybersecurity reports that have raised alarms across the Philippine public sector.

While the commission has been coordinating with various offices to verify the extent of these incidents, it maintains that reports of leaks do not automatically confirm a violation of the Data Privacy Act of 2012.

The situation began to unfold in early November after cybersecurity advocacy group Deep Web Konek flagged a wave of suspected exposures. These reports implicated a wide range of institutions, including the Department of Transportation, the Philippine Coast Guard, and the Bureau of Internal Revenue (BIR).

By Tuesday, November 10, the NPC confirmed it had officially received notifications from 10 agencies, including the Department of Information and Communications Technology, the Department of Justice, and the Philippine Amusement and Gaming Corp., as reported by RAPPLER.

Verifying the Scope of Data Exposure

The alleged leaks involve a diverse array of sensitive information. In the case of the Department of Transportation, a threat actor operating under the alias “sinigangmixwithgabi” claimed to possess payroll, attendance, and biometric records of over 4,500 employees.

Meanwhile, the group DeathNoteHackers purported to hold 1.35 gigabytes of data from the Philippine Coast Guard, containing rescue records and location information, according to the Philippine News Agency. These claims remain unverified by the government agencies involved.

NPC confirms data breach notices from 10 gov't agencies MANILA – Ten government agencies have notified the National Privacy Commission (NPC) of personal data breaches, as the NPC reminded agencies that reporting an incident is only part of their responsibility. "Equally… pic.twitter.com/BmoF5YfSpH”

— Post by @pnagovph on X

The military has also been drawn into the investigation. The Armed Forces of the Philippines (AFP) is currently probing reports involving the Philippine Air Force.

“At this point, these are mere speculations,” AFP spokesperson Col. Francel Margareth Padilla told the Inquirer, noting that military cybersecurity units are working to verify the integrity of their systems. She added that while no system is truly impenetrable, the focus remains on maintaining robust security protocols.

Accountability Under the Law

The NPC has issued a stern reminder that filing a breach notification, as required under NPC Circular 16-03, is merely the first step in regulatory compliance. Deputy Privacy Commissioner Jose Belarmino II emphasized that agencies are not exempt from liability simply because they reported an incident.

According to Philstar.com, the commission is currently reviewing each submission through its Compliance and Monitoring Division to determine if the agencies took adequate steps to protect citizen data.

“Breach notification is only one part of an agency’s responsibility under the Data Privacy Act. Equally important is how the agency responds to the incident, protects the individuals who may be affected and addresses the vulnerabilities that may have contributed to the breach, said Belarmino.”

The Bureau of Internal Revenue, one of the agencies that filed a notification, stated in an advisory on November 10 that while taxpayer profile information may have been exposed, the integrity of their core database remains intact. The BIR confirmed that no taxpayer information was modified and that they are currently strengthening access controls to address identified vulnerabilities.

The Risk to Third-Party Custodians

A significant portion of the ongoing investigation centers on the role of external contractors. The NPC reiterated that under Section 21 of the Data Privacy Act, government agencies remain fully accountable for the data they hold, even when processing is outsourced to third-party vendors. This serves as a warning to all public offices: the legal burden of data protection cannot be offloaded.

Photo: Inquirer

As the commission continues its assessment, the public is being advised to remain vigilant. The BIR has specifically urged taxpayers to enable multi-factor authentication and monitor their accounts for suspicious activity. While the government works to verify the claims made by groups like Deep Web Konek, the incident underscores the growing pressure on national infrastructure to defend against increasingly sophisticated digital threats.