Philippine Government Data Breach Claims: Are Citizens at Risk?

Hackers have claimed access to information held by several Philippine government agencies, including employment records, military personnel files and internal government documents. The claims have raised concerns about whether people’s personal information is safe, but the full picture is still unclear. No official investigation has yet established how many of the reported systems were accessed or whether the advertised datasets contain genuine government records.

The reports began circulating on November 5, 2026, when cybersecurity monitoring group Deep Web Konek identified claims posted on underground cybercrime forums. The organisations named included the Department of Information and Communications Technology (DICT), the Office of the Vice President (OVP), the Presidential Commission on Good Government (PCGG), the Philippine Air Force and PhilJobNet, the employment portal operated by the Department of Labor and Employment (DOLE).

The claims involved different systems and types of activity. Some threat actors advertised files they said they had taken from government systems. Other reports described a website defacement or a service disruption. These incidents should not be treated as one confirmed attack, and the available information does not establish that the groups involved were working together.

One of the largest claims concerned PhilJobNet. A threat actor using the name DeathNoteHackers claimed to have obtained around 19.2 million records from the employment portal. The advertised dataset was reportedly about 5.74GB and was said to contain names, contact details, residential addresses and Taxpayer Identification Numbers.

PhilJobNet is a real government service. The DOLE Bureau of Local Employment says it monitors and evaluates the portal, while the platform’s official website describes it as a job-matching service with a central database maintained by the Bureau of Local Employment.

That confirms the portal’s connection to DOLE, but it does not confirm the alleged data theft. The figure of 19.2 million records and the description of the files came from the threat actor’s claim. Neither the number of records nor their authenticity has been independently established. It would therefore be inaccurate to say that 19.2 million people have been affected.

DeathNoteHackers also claimed to have obtained around 10GB of files from a scheduling platform used by the Office of the Vice President. The same actor advertised a separate collection of about 11GB allegedly taken from the Philippine Air Force’s Command Clearance System. The forum listing claimed that the files included personnel documents, birth certificates, government-issued identification, marriage certificates, command orders and Statements of Assets, Liabilities and Net Worth.

The Philippine Air Force was also named in a separate claim involving its Human Resource Management Information System. Another threat actor, Happy Go Lucky PH, claimed to have obtained around 8GB of internal documents and employee information from the PCGG. It also alleged that its initial access involved a DICT staging server, but that claimed connection has not been independently established.

A separate post attributed to an account called core849 advertised around 3.6GB of documents allegedly taken from DICT. TechSabado reported that the advertised material included procurement, budget and administrative documents. One described sample concerned a proposed Active Cellular Identification and Cybersecurity System for ASEAN 2026 and listed an estimated approved budget of PHP160 million. The appearance of a document in a forum listing does not, by itself, establish how it was obtained or whether the wider collection was taken from DICT systems.

The DICT claims received further attention on November 6, when Bilyonaryo News Channel reported an alleged intrusion into DocTracks, an internal document-management platform used by the department. According to an unnamed source cited by BNC, the system processes incoming correspondence and routes documents to the Office of the Secretary, other DICT divisions and external government agencies. The source said documents had been obtained and that their authenticity had been checked.

However, BNC’s report did not establish when the alleged intrusion happened, how access was gained or how many documents may have been compromised. It also did not establish whether the reported documents were publicly released. This is a separate allegation from the forum post advertising 3.6GB of DICT documents; the available reporting does not establish that the two claims describe the same access or dataset.

Other organisations also appeared in the reports. Eastern Visayas State University’s Human Resource Management Information System was mentioned in a post attributed to actors associated with DeathNoteHackers. The group reportedly said it would not publicly release the material after a student contacted it, while raising concerns about the system’s security. That account does not establish whether student or staff records were actually taken.

The Philippine Nurses Association’s website was reportedly defaced with a message claiming responsibility. A defaced website means that someone has changed what visitors see on a page; it does not automatically mean that the site’s database or personal records were stolen. The available reporting did not establish which vulnerability was used or whether information was extracted.

Other reported incidents included a denial-of-service attack involving the Department of Science and Technology, and an incident involving the Department of the Interior and Local Government. The nature and extent of the DILG incident were not specified in the reporting reviewed. The Philippine Amusement and Gaming Corporation was also named in connection with information concerning its National Database of Restricted Persons, but the available report did not establish whether records had been obtained through unauthorised access or publicly disclosed.

Further claims appeared on November 6. A threat actor using the name sinigangmixwithgabi claimed to have accessed the Department of Transportation’s Human Resource Information System and advertised records allegedly covering around 4,534 employees. The claimed material included personnel, payroll and attendance information, account records, biometric identifiers and copies of application source code.

DeathNoteHackers also claimed to hold information associated with the Philippine Coast Guard, including personnel details, rescue records, photographs and location information. A screenshot described in reporting by the Philippine News Agency indicated a folder containing about 1.35GB across 6,698 files and 3,411 folders. Those figures describe what the screenshot allegedly showed; they do not verify the files’ origin, contents or authenticity. Neither the DOTr nor the Coast Guard claims had been independently verified in the reports reviewed.

Separate reporting also identified claims involving the Securities and Exchange Commission and the Bureau of Internal Revenue. Radar reported that files attributed to the same forum account had been shared on underground forums. The available information did not establish the authenticity, scope or sensitivity of those files. These claims should not be confused with confirmed access to the agencies’ databases.

The Office of the Vice President responded to the scheduling-platform allegation on November 5. It said the platform was operated by a third party and was not an official government website. The OVP also said it did not contain confidential government files or classified government information. The office questioned the timing of the allegations and suggested they could be politically motivated.

The OVP’s statement is important, but it does not settle every question. The office did not explicitly confirm or deny whether the third-party platform itself had been accessed. Its position about the type of information held on the platform should also be distinguished from the separate reporting by Bilyonaryo News Channel about executive briefing documents concerning the Vice President’s meetings with foreign ambassadors. BNC reported that it had obtained documents containing meeting details and proposed talking points, with some marked confidential. The source of those documents, how they were obtained and whether they were connected to the scheduling platform have not been established. The two reports should not be treated as proof that the documents came from the platform.

There was another significant development on November 5. National Bureau of Investigation Director Melvin Matibag told the Daily Tribune that the bureau had blocked around 47,000 attempted intrusions against its servers. He said the NBI’s IT team had blocked the attempts and that the bureau was investigating who was responsible. This is a separate reported security development. There is no verified evidence linking those attempts to the claims involving the other government agencies.

The government had also discussed cyber threats before the November 5 reports emerged. On November 4, the Philippine News Agency reported that the National Cybersecurity Inter-Agency Committee had finalised a resolution supporting continued use of a government disruption playbook. DICT Secretary Robert Joseph de Claro described measures including stronger protection for government websites, checks for suspected system compromises, improved incident reporting and coordination between agencies. This shows that the government was working on broader cyber-defence measures before the claims circulated. It does not prove that officials anticipated these particular incidents or that the measures prevented or contained them.

The National Privacy Commission (NPC) addressed the reports on November 6. In an official statement, the regulator said it was aware of alleged data leaks involving government agencies on November 5. It also said that, as of November 6, it had not received personal data breach notifications from the agencies concerned.

The NPC said it would coordinate directly with those agencies to verify the incidents, establish what happened and determine whether personal information had been compromised. Where necessary, it may require agencies to submit reports and meet their obligations under the Data Privacy Act of 2012.

The Commission also explained the 72-hour notification requirement under NPC Circular No. 16-03. Organisations responsible for personal information must notify the NPC and affected individuals within 72 hours after becoming aware of, or having reasonable grounds to believe, that a personal data breach requiring mandatory notification has occurred. The deadline does not automatically begin when someone posts a hacking claim online. The incident must meet the rules for mandatory notification.

ALSO SEE Why Has New York Restricted AI Chatbot Features for Children?

The NPC made one point especially clear: reports of alleged data leaks do not, by themselves, prove that a personal data breach has occurred or that the Data Privacy Act has been violated. Each incident needs to be assessed on its own facts.

As of the latest public information reviewed for this report, we could not locate an incident-specific public statement from DICT, DOLE or the Philippine Air Force confirming the alleged data exposures. The NPC has confirmed that it is checking the reports, but it has not confirmed that the advertised datasets are genuine. The OVP has issued a response about its scheduling platform, while the other claims remain subject to verification.

For people who use these government services, the concern is understandable. If genuine records containing names, addresses, contact details, employment information or identification details were exposed, criminals could potentially use them to create convincing scam messages, impersonate organisations or target individuals with fraud attempts. But there is currently no verified figure for how many people, if any, have been affected by these reported incidents.

People should be cautious of unexpected messages claiming to come from government agencies. Do not follow suspicious links, provide passwords or share one-time verification codes in response to unsolicited requests. If a message refers to an employment application, government benefit or official record, check it through the agency’s official website or contact channel rather than using the link in the message. Avoid downloading or sharing files advertised as stolen government records.

The November 5 claims also used Guy Fawkes Day and Million Mask March references. The date is associated with protest imagery used by hacktivist movements, and some threat actors invoked that symbolism in their posts. However, the timing does not prove that the incidents were coordinated or that the different actors belonged to one group.

The central questions are still being investigated: which systems, if any, were accessed without permission; whether the advertised files are genuine; what information they contain; and whether anyone’s personal data was exposed. The National Privacy Commission’s checks and any further statements from the agencies will help establish what happened.

How We Checked This

Secritic reviewed the National Privacy Commission’s statement, official PhilJobNet information, the OVP’s response and published reports about the alleged incidents. The advertised datasets, record counts and claims of unauthorised access remain unverified. We distinguish official information from allegations and will update this report when further verified details emerge.