MANILA, Philippines — Sensitive personal information may have been exposed in recent data breaches affecting multiple government agencies.
Cybercrime Investigation and Coordinating Center (CICC) Executive Director Alexander “Aboy” Paraiso confirmed in a radio interview on Friday, November 13, that personal data from around 20 state agencies were exposed.
As of Tuesday, November 10, only 10 of these agencies had submitted personal data breach notifications to the National Privacy Commission (NPC).
Must Read NPC sounds alarm as 10 gov’t agencies report leaks
Rappler reached out to the 10 agencies identified by the NPC to determine the extent of each data breach.
Based on public advisories, disclosures, and statements, here is what is known so far about the information potentially exposed:
Bureau of Internal Revenue (BIR)In an advisory released on November 10, the BIR said its initial findings showed that only “certain taxpayer profile information” may have been exposed.
The tax bureau also stated that taxpayer information was not “modified or lost,” and that filing and payment records were unaffected.
But CICC Executive Director Paraiso shared that names, business addresses, and Taxpayer Identification Numbers (TIN) of around 20,000 to 50,000 taxpayers may have been compromised.
Securities and Exchange Commission (SEC)The SEC said it discovered on November 6 that individual profile information from its online platforms and databases may have been compromised.
The commission informed users of its online platforms via email on Monday, November 9, that their full names, usernames, email addresses, mobile numbers, birth dates, genders, addresses, and TINs were possibly leaked.
According to a statement published the same day, SEC explained that company records and passwords were not exposed in the breach.
Philippine Amusement and Gaming Corporation (Pagcor)In an advisory released on Wednesday, November 11, Pagcor said it was investigating a potential breach of its National Database of Restricted Persons (NDRP).
The NDRP contains the personal information of individuals banned from entering and playing in Pagcor-authorized gaming premises in the country.
Presidential Decree No. 1869, or the Pagcor Charter, states that the following persons are included in the NDRP:
- Government officials and employees
- Members of the Armed Forces of the Philippines and Philippine National Police
- Persons under 21 years old or a student of any school in the Philippines
- Employees of gaming licensees or Gaming Employment License holders
It also includes the names of individuals under voluntary or family-applied exclusion programs.
The same database was hacked last year, with Pagcor sharing that the database contains around 560,000 names and clarifying that these are not “addicted gamblers.”
The remaining seven agencies on the NPC’s list had yet to respond to Rappler’s request for comment as of Sunday, November 15. The NPC and CICC had also not responded to Rappler’s requests for additional information.
Republic Act No. 10173, or the Data Privacy Act of 2012, requires personal information controllers such as government offices to notify the NPC and affected individuals if any of their data may have been compromised.
This story will be updated as more government agencies release information about the data breaches. – Rappler.com