Philippine agencies named in a wave of hack and leak claims
On 5 November 2026 forum users and hacktivist groups claimed data leaks, defacements and a DDoS against Philippine agencies, universities and associations, with more claims on 6 November. Most remain unverified, and the privacy commission had received no breach notifications by 6 November.
Key facts
- OrganisationAbout a dozen Philippine government bodies, including the OVP, PhilJobNet (DOLE), PAF, PCG, PCGG, DICT, DILG, PAGCOR, DOTr, SEC and BIR, plus two universities and two associations.
- What happenedDeep Web Konek reported files from eight agencies posted to hacker forums on 5 November and three more on 6 November. Monitors also reported website defacements and a DOST website outage.
- ClaimedDeathNote Hackers claim about 19.2 million PhilJobNet records, about 10 GB from the OVP scheduling platform and about 1.35 GB from the PCG. HappyGoLuckyPH claims about 8 GB from the PCGG and a DILG system. Forum users claim PAF personnel files, DICT documents, NEUST student data, PAGCOR's restricted persons list, and DOTr, SEC and BIR files.
- ConfirmedBIR says it is investigating an alleged leak. The OVP says the platform is run by a third party and holds no confidential or classified files, without confirming or denying a breach. No other named body had commented in the reports.
- Defacements and outageNullsec Philippines defaced the Philippine Nurses Association site. Monitors also reported defacements of a Bataan government site and Alliance Graduate School, and the DOST website was down for several hours in what reports called a DDoS.
- AuthoritiesThe National Privacy Commission says it will verify the reports and reminds agencies of the 72-hour breach notification rule. BIR is working with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group.
Timeline
- 5 Nov 2026Deep Web Konek reports forum posts naming eight agencies, including the OVP, PhilJobNet, PCG, PCGG, DILG, PAF, DICT and PAGCOR. Philstar Tech counts seven alleged breaches plus two website incidents. Philstar Tech · Radar PH
- 5 Nov 2026Defacements are reported at the Philippine Nurses Association, a Bataan government site and Alliance Graduate School. The DOST website is unreachable for several hours. Philstar Tech · Newsbytes.PH
- 5 Nov 2026The OVP calls the claims unverified and possibly politically timed, and says the third-party scheduling platform holds no classified files. Politiko
- 6 Nov 2026Deep Web Konek reports three more claims: forum user sinigangmixwithgabi posts SEC and BIR files and DOTr HRIS data on about 4,534 employees. Its tally reaches 11 agencies. Radar PH · Astig.ph
- 6 Nov 2026The NPC says it has received no breach notifications and that alleged leaks do not by themselves establish a breach. It will verify the reports with the agencies. Newsbytes.PH · Radar PH
- 7 Nov 2026BIR says it is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group. It gives no detail on the data involved. GMA News
Affected organisations
| Organisation | Date | Sector | Type | Actor | What happened | Sources |
|---|---|---|---|---|---|---|
 ✅ ConfirmedBureau of Internal Revenue (BIR) | 7 Nov 2026 | Government | Data leak | None | Confirmed. BIR is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group. Claimed. Posts online allege BIR data was leaked; extent not stated. | GMA News✓ 7 Nov |
 ⚠️ ClaimedDepartment of Transportation (DOTr) HRIS | 6 Nov 2026 | Transport | Data leak | sinigangmixwithgabi | Claimed. A forum user claimed payroll, attendance and biometric records for about 4,534 DOTr employees plus HRIS source code. | Astig.ph · Radar PH · HackNotice✓ 7 Nov |
 ⚠️ ClaimedSecurities and Exchange Commission (SEC) | 6 Nov 2026 | Finance | Data leak | sinigangmixwithgabi | Claimed. A forum user claimed files from the SEC. | Radar PH✓ 7 Nov |
 ⚠️ ClaimedOffice of the Vice PresidentVia a vendor | 5 Nov 2026 | Government | Data leak | DeathNote Hackers | Response. The OVP says the scheduling platform is run by a third party and holds no classified files, without confirming or denying a breach. Claimed. DeathNoteHackers claims about 10 GB of documents from the platform. | Politiko✓ 7 Nov |
 ⚠️ ClaimedPhilJobNet (DOLE) | 5 Nov 2026 | Government | Data leak | DeathNote Hackers | Claimed. DeathNote Hackers claims about 19.2 million records from the government job portal. | Philstar Tech✓ 7 Nov |
 ⚠️ ClaimedPhilippine Air Force | 5 Nov 2026 | Government | Data leak | None | Claimed. A forum user claims about 11 GB of files including personnel records and ID copies. | Philstar Tech✓ 7 Nov |
 ⚠️ ClaimedPhilippine Coast Guard | 5 Nov 2026 | Government | Data leak | DeathNote Hackers | Claimed. DeathNoteHackers claimed about 1.35 GB across 6,698 files, including personnel and rescue records. | Astig.ph · Radar PH✓ 7 Nov |
 ⚠️ ClaimedPresidential Commission on Good Government (PCGG) | 5 Nov 2026 | Government | Data leak | HappyGoLuckyPH | Claimed. HappyGoLuckyPH claimed about 8 GB of PCGG data. | Philstar Tech · Radar PH✓ 7 Nov |
 ⚠️ ClaimedDepartment of Information and Communications Technology (DICT) internal files | 5 Nov 2026 | Government | Data leak | core849 | Claimed. A forum user claimed about 3.6 GB of internal DICT documents, including procurement and budget records. Bilyonaryo News Channel, citing a source, reports the intrusion hit DocTracks, the internal document-routing system; DICT has not commented. | Philstar Tech · Radar PH · Bilyonaryo News Channel✓ 8 Nov |
 ⚠️ ClaimedNueva Ecija University of Science and Technology (NEUST) | 5 Nov 2026 | Education | Data leak | None | Claimed. A forum user claimed personal and academic data on more than 81,000 NEUST students. | Philstar Tech✓ 7 Nov |
 ⚠️ ClaimedDILG Local Government Unit Support System | 5 Nov 2026 | Government | Data leak | HappyGoLuckyPH | Claimed. HappyGoLuckyPH claimed a breach of the DILG LGU support system. | Radar PH✓ 7 Nov |
 ⚠️ ClaimedPhilippine Amusement and Gaming Corporation (PAGCOR) | 5 Nov 2026 | Government | Data leak | Porman2344 | Claimed. A forum user claimed PAGCOR's National Database of Restricted Persons. | Radar PH✓ 7 Nov |
 ⚠️ ClaimedEastern Visayas State University | 5 Nov 2026 | Education | Intrusion | None | Claimed. Monitors listed the university among the 5 November alleged hacking incidents. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedBataan provincial government website | 5 Nov 2026 | Government | Defacement | None | Claimed. Monitors reported a defacement of a Bataan government website. | Newsbytes.PH · Astig.ph✓ 7 Nov |
 ⚠️ ClaimedPhilippine Nurses Association | 5 Nov 2026 | Health | Defacement | Nullsec Philippines | Claimed. The association's website was defaced with a Nullsec Philippines message. | Philstar Tech · Newsbytes.PH✓ 7 Nov |
| ⚠️ ClaimedAlliance Graduate School | 5 Nov 2026 | Education | Defacement | None | Claimed. Monitors reported a defacement of the school's website. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedDepartment of Science and Technology (DOST) website | 5 Nov 2026 | Government | DDoS | None | Claimed. Reports described a DDoS attack that left the DOST website inaccessible for several hours; the cause was not confirmed. | Philstar Tech · Bilyonaryo✓ 7 Nov |
What to do
- If you think your data was exposed, file a complaint with the National Privacy Commission through privacy.gov.ph.
- Report scams, hacking or misuse of your personal data to the CICC hotline 1326.
- Expect phishing that quotes your name, employee ID or job application details. Verify any message claiming to be from DOLE, BIR, SEC or your employer through the agency's official website before clicking links.
- Government employees named in the PAF, PCG or DOTr claims should watch for payroll or ID fraud and report anything odd to their HR office.
FAQ
Were Philippine government agencies hacked on 5 November 2026?
Hackers and forum users claimed leaks from about a dozen bodies, and several websites were defaced or knocked offline. Most leak claims are unverified, and the NPC had received no breach notifications by 6 November.
Who claimed the attacks?
DeathNote Hackers claimed the OVP, PhilJobNet and PCG. HappyGoLuckyPH claimed the PCGG and a DILG system. Nullsec Philippines defaced the Philippine Nurses Association site. Other claims came from individual forum users such as core849, Porman2344 and sinigangmixwithgabi.
Why 5 November?
BetterGov.PH noted the incidents fell on the annual Million Mask March, when protesters wear Guy Fawkes masks, and that similar incidents happened around that date in earlier years. No link to these attacks has been established. DICT recorded 38 incidents on 5 November 2025.
Related stories
- Bank Rakyat website defacement Malaysia · 6 Nov 2026
- M1 customer data breach Singapore · 6 Nov 2026
- Amadeus airline data breach South Korea, Japan, Hong Kong +3 · 4 Nov 2026
- Crédit Mutuel Arkéa loses about 100 million euros to fraudulent transfers France · 4 Nov 2026
Checked 8 Nov 2026. Methodology · Data CC BY 4.0