Philippines Cyber Watch
Reports since 1 Jan 2026. Not a live feed.
Threat level, Philippines
Background readingHacktivismIncident response
No public level found
No published national cyber threat level found for The Philippines, checked 7 Nov 2026. DICT and CERT-PH issue advisories; the National Privacy Commission handles breach notifications.
Source: DICT (CERT-PH)
From official agencies
| Date | Agency | Advisory or alert |
|---|
Agency headlines, unedited.
Compare countries
| Country | Threat level | Confirmed | Claimed only | Via a vendor | Latest report |
|---|---|---|---|---|---|
 Malaysia | Medium | 19 | 35 | 7 | 7 Nov 2026 |
 Singapore | None published | 12 | 24 | 3 | 7 Nov 2026 |
 Indonesia | None published | 6 | 32 | 0 | 5 Nov 2026 |
 Thailand | None published | 9 | 33 | 0 | 3 Nov 2026 |
| Philippines | None published | 9 | 35 | 4 | 7 Nov 2026 |
 Vietnam | None published | 5 | 34 | 0 | 5 Nov 2026 |
 Israel | None published | 4 | 2 | 0 | 7 Nov 2026 |
 Iran | None published | 4 | 0 | 0 | 13 Jun 2026 |
 United Arab Emirates | None published | 4 | 4 | 1 | 7 Oct 2026 |
 Saudi Arabia | None published | 2 | 5 | 0 | 12 Oct 2026 |
 Egypt | None published | 1 | 4 | 1 | 29 Oct 2026 |
 South Africa | None published | 8 | 0 | 1 | 26 Oct 2026 |
 Nigeria | None published | 2 | 3 | 0 | 8 Aug 2026 |
 Kenya | None published | 1 | 6 | 0 | 25 Jul 2026 |
 India | None published | 9 | 2 | 1 | 28 Oct 2026 |
 Pakistan | None published | 3 | 3 | 0 | 22 Jul 2026 |
 Bangladesh | None published | 1 | 5 | 0 | 23 Oct 2026 |
 Sri Lanka | None published | 4 | 3 | 1 | 1 Jul 2026 |
 Cambodia | None published | 0 | 3 | 0 | 10 Jun 2026 |
 Myanmar | None published | 1 | 5 | 0 | 25 Oct 2026 |
 Brunei | None published | 0 | 0 | 0 | |
 Poland | BRAVO-CRP | 5 | 0 | 4 | 1 Oct 2026 |
 Ukraine | None published | 7 | 0 | 1 | 4 Nov 2026 |
 Russia | None published | 7 | 0 | 1 | 1 Nov 2026 |
 Czechia | None published | 3 | 0 | 1 | 22 Oct 2026 |
 Romania | None published | 2 | 0 | 0 | 14 Jul 2026 |
 Estonia | None published | 5 | 0 | 3 | 4 Nov 2026 |
 Turkey | None published | 3 | 0 | 1 | 16 Sep 2026 |
 United Kingdom | None published | 5 | 1 | 3 | 2 Nov 2026 |
 Germany | None published | 4 | 0 | 1 | 2 Nov 2026 |
 France | None published | 7 | 0 | 2 | 4 Nov 2026 |
 Netherlands | None published | 5 | 1 | 1 | 2 Nov 2026 |
 Italy | None published | 5 | 0 | 0 | 7 Nov 2026 |
 Spain | None published | 3 | 0 | 0 | 5 Feb 2026 |
 Ireland | None published | 3 | 4 | 0 | 2 Nov 2026 |
 Sweden | None published | 5 | 3 | 2 | 2 Nov 2026 |
 United States | None published | 6 | 0 | 2 | 28 Aug 2026 |
 Canada | None published | 5 | 0 | 1 | 21 Aug 2026 |
 Mexico | None published | 2 | 4 | 1 | 21 Aug 2026 |
 Brazil | None published | 2 | 2 | 0 | 2 Nov 2026 |
 Argentina | None published | 1 | 2 | 0 | 4 Aug 2026 |
 Chile | None published | 1 | 2 | 0 | 2 Nov 2026 |
 Colombia | None published | 1 | 2 | 0 | 4 Nov 2026 |
 Japan | None published | 9 | 0 | 5 | 4 Nov 2026 |
 South Korea | Caution | 6 | 0 | 2 | 29 Oct 2026 |
 China | None published | 0 | 3 | 0 | 7 Aug 2026 |
 Taiwan | None published | 9 | 0 | 2 | 3 Nov 2026 |
 Hong Kong | None published | 3 | 0 | 3 | 30 Oct 2026 |
 Australia | None published | 5 | 0 | 1 | 2 Nov 2026 |
 New Zealand | None published | 7 | 2 | 1 | 3 Sep 2026 |
2026 counts. Click a row to open a country.
Official numbers
| Measure | Value | Period | Source |
|---|---|---|---|
| CICC cybercrime complaints | 18,633 | 2025 (announced 22 Jan 2026) | GMA News |
| CICC consumer fraud complaints | 6,453 | 2025 (announced 22 Jan 2026) | GMA News |
| Losses reported to CICC (fraud, hacking, phishing) | PHP 418.187 million | 2025 (announced 22 Jan 2026) | GMA News |
| PNP-ACG cybercrime arrests | 332 | Q1 2026 | GMA News |
| PNP-ACG cases referred | 593 | Q1 2026 | GMA News |
| PNP-ACG cybercrime convictions | 143 | Q1 2026 | GMA News |
| PNP-ACG cybercrime arrests | 766 | January to July 2026 | Technobaboy |
| PNP-ACG referred cybercrime cases | 144 | October 2026 | Daily Tribune |
| Cases filed under AFASA | More than 500 | As of 23 Jul 2026 | GMA News |
| Hospital data breach reports received by NPC | 18 | Cumulative as of 3 Nov 2026 | GMA News |
Who is targeting it
| Group | Kind | What it did | Sources | Reports |
|---|---|---|---|---|
| Qilin | Ransomware | Most active ransomware group against Philippine firms in 2026, listing PSBank, Megawide, Philex Mining and Globalport Terminals. | Ransomware.live (Philippines) · Cyber Security Asia (Check Point report) | Profile |
| The Gentlemen | Ransomware | Listed DTI Foreign Trade Service Corps, PTT Philippines, White Beach Hotel and PSBank between January and August. | Ransomware.live (Philippines) | Profile |
| Payload | Ransomware | Listed four Philippine firms in March and April, including TS Lines Philippines and Sunlight Express Airways. | Ransomware.live (Philippines) | Profile |
| DragonForce | Ransomware | Listed Alliance Select Foods, Panorama BPO and Trans World Trading. | Ransomware.live (Philippines) | Profile |
| LockBit 5.0 | Ransomware | Claimed Pricon Microelectronics, whose parent confirmed a ransomware attack, and Feliz Hotel Boracay. | Ransomware.live (Philippines) · DeXpose | Profile |
| Emperador | Ransomware | New group that claimed 2.9 GB from the City Government of Baguio in August. | Ransomware.live | Profile |
| Bashe (APT73) | Extortion | Listed about 50 GB of alleged DPWH files in March and the dpwh.gov.ph domain in April. | Daily Tribune | Profile |
| DeathNoteHackers | Hacktivist | Claimed the PhilJobNet, Office of the Vice President and Philippine Coast Guard data on 5 November. | Radar PH · Philstar Tech | Profile |
| HappyGoLuckyPH | Hacktivist | Defaced the DMW website in September and claimed PCGG and DILG data on 5 November. | Newsbytes.PH · Radar PH | |
| Nullsec Philippines | Hacktivist | Defaced the Senate website in June and the Philippine Nurses Association site in November. | Philstar · Philstar Tech | |
| core849 | Unattributed | Forum user tied to the LTFRB, DICT D-TAP and DICT internal-file claims between September and November. | Astig.ph · Radar PH | Profile |
| sinigangmixwithgabi | Unattributed | Forum user who claimed DOTr, SEC and BIR files on 6 November. | Radar PH · Astig.ph | |
| Chinese state-sponsored actors | State-aligned | Microsoft ranked the Philippines fifth among targets of Chinese state cyber operations, and Hunt.io tied a Chinese-speaking operator to theft from the Philippine Nuclear Research Institute. | GMA News · Cybersecurity News |
Laws and rules this year
- 29 Oct 2026NTC order on subscribers with more than 100 SIMs. Telcos have 15 days to verify owners of more than 100 SIMs and deactivate SIMs without proven control and legitimate use. Source
- 8 Sep 2026DICT and CICC 24-hour cyber readiness order. Agencies, GOCCs, LGUs and critical infrastructure operators had 24 hours to fix critical gaps and file a one-page readiness assessment. Source
- 14 Aug 2026NPC draft updated Privacy Impact Assessment guidelines. Public consultation closed on a draft circular replacing the blanket PIA duty with a risk-tiered framework. Source
- 12 Aug 2026House passes HB 9605, National Cybersecurity and Critical Information Infrastructure Protection Act. The House approved, 198 to 3, a bill creating a National Cybersecurity Agency and minimum security duties for agencies and critical infrastructure; it awaits Senate action. Source
- 3 Aug 2026DOJ and BSP AFASA information-sharing agreement. The BSP will refer financial account scam reports to the DOJ, which gets access to account information for prosecutions. Source
- 25 Jun 2026AFASA fraud management deadline (BSP Circular 1213). Banks and e-wallets had to upgrade fraud management systems and limit interceptable authentication such as SMS OTPs, or face reimbursing victims. Source
Full stories
- Philippine agencies named in a wave of hack and leak claims Philippines · 7 Nov 2026
Official statements
- 7 Nov 2026PNP reported eight cybercrime convictions and 144 referred cases for October. Daily Tribune
- 6 Nov 2026The privacy commission will verify reported 5 Nov leaks at several agencies and reminds them of the 72-hour notification rule. Newsbytes.PH
- 6 Nov 2026NPC said it had received no breach notifications from agencies named in the 5 November leak claims and would verify them. Newsbytes.PH
- 30 Oct 2026NPC confirmed it received a personal data breach notification from St. Luke's Medical Center. GMA News
- 29 Oct 2026NTC ordered telcos to verify subscribers holding more than 100 SIMs within 15 days. The Manila Times
- 27 Oct 2026DICT advised agencies to harden defenses around 5 November and said the advisory did not confirm an imminent attack. Philstar Tech
- 22 Oct 2026CERT-PH tells government and private organisations running PHP to patch PHP2Shell; no local compromise established. Newsbytes.PH
- 25 Sep 2026DICT said NCERT was handling a possible data exposure involving a D-TAP accredited provider. Astig.ph
- 19 Sep 2026LTFRB confirmed a data breach and took its Electronic Support System offline. Newsbytes.PH
- 8 Sep 2026DICT and CICC ordered agencies and critical infrastructure operators to complete 24-hour cyber readiness checks. Newsbytes.PH
- 7 Sep 2026DICT said NCERT detected unauthorized access to the DMW website and that a PPA ransomware report was a false positive. Newsbytes.PH
- 23 Jul 2026BSP general counsel Roberto Figueroa said banks that fail AFASA requirements may have to fully reimburse victims. GMA News
- 11 Jun 2026The Senate EDP-MIS bureau confirmed its website was defaced and said no sensitive data was compromised. Philstar
- 6 Apr 2026PNP-ACG reported 332 cybercrime arrests and 593 referred cases in Q1 2026. GMA News
- 23 Mar 2026DPWH Secretary Vince Dizon said initial findings showed systems secure after a 50 GB leak claim. Daily Tribune
- 20 Mar 2026DICT said it found no verified breach of eGov PH core infrastructure. Newsbytes.PH
- 22 Jan 2026CICC reported 18,633 cybercrime complaints and PHP 418.187 million in losses for 2025. GMA News
Incidents
44 of 44 incidents
| What happened | Sources | |||||
|---|---|---|---|---|---|---|
 ✅ ConfirmedBureau of Internal Revenue (BIR)Full story | 7 Nov 2026 | Government | Data leak | None | Confirmed. BIR is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group. Claimed. Posts online allege BIR data was leaked; extent not stated. | GMA News✓ 7 Nov |
 ⚠️ ClaimedDepartment of Transportation (DOTr) HRISFull story | 6 Nov 2026 | Transport | Data leak | Claimed. A forum user claimed payroll, attendance and biometric records for about 4,534 DOTr employees plus HRIS source code. | Astig.ph · Radar PH · HackNotice✓ 7 Nov | |
 ⚠️ ClaimedSecurities and Exchange Commission (SEC)Full story | 6 Nov 2026 | Finance | Data leak | Claimed. A forum user claimed files from the SEC. | Radar PH✓ 7 Nov | |
 ⚠️ ClaimedOffice of the Vice PresidentVia a vendorFull story | 5 Nov 2026 | Government | Data leak | Response. The OVP says the scheduling platform is run by a third party and holds no classified files, without confirming or denying a breach. Claimed. DeathNoteHackers claims about 10 GB of documents from the platform. | Politiko✓ 7 Nov | |
 ⚠️ ClaimedPhilJobNet (DOLE)Full story | 5 Nov 2026 | Government | Data leak | Claimed. DeathNote Hackers claims about 19.2 million records from the government job portal. | Philstar Tech✓ 7 Nov | |
 ⚠️ ClaimedPhilippine Air ForceFull story | 5 Nov 2026 | Government | Data leak | None | Claimed. A forum user claims about 11 GB of files including personnel records and ID copies. | Philstar Tech✓ 7 Nov |
 ⚠️ ClaimedPhilippine Coast GuardFull story | 5 Nov 2026 | Government | Data leak | Claimed. DeathNoteHackers claimed about 1.35 GB across 6,698 files, including personnel and rescue records. | Astig.ph · Radar PH✓ 7 Nov | |
 ⚠️ ClaimedPresidential Commission on Good Government (PCGG)Full story | 5 Nov 2026 | Government | Data leak | Claimed. HappyGoLuckyPH claimed about 8 GB of PCGG data. | Philstar Tech · Radar PH✓ 7 Nov | |
 ⚠️ ClaimedDepartment of Information and Communications Technology (DICT) internal filesFull story | 5 Nov 2026 | Government | Data leak | Claimed. A forum user claimed about 3.6 GB of internal DICT documents, including procurement and budget records. Bilyonaryo News Channel, citing a source, reports the intrusion hit DocTracks, the internal document-routing system; DICT has not commented. | Philstar Tech · Radar PH · Bilyonaryo News Channel✓ 8 Nov | |
 ⚠️ ClaimedNueva Ecija University of Science and Technology (NEUST)Full story | 5 Nov 2026 | Education | Data leak | None | Claimed. A forum user claimed personal and academic data on more than 81,000 NEUST students. | Philstar Tech✓ 7 Nov |
 ⚠️ ClaimedDILG Local Government Unit Support SystemFull story | 5 Nov 2026 | Government | Data leak | Claimed. HappyGoLuckyPH claimed a breach of the DILG LGU support system. | Radar PH✓ 7 Nov | |
 ⚠️ ClaimedPhilippine Amusement and Gaming Corporation (PAGCOR)Full story | 5 Nov 2026 | Government | Data leak | Claimed. A forum user claimed PAGCOR's National Database of Restricted Persons. | Radar PH✓ 7 Nov | |
 ⚠️ ClaimedEastern Visayas State UniversityFull story | 5 Nov 2026 | Education | Intrusion | None | Claimed. Monitors listed the university among the 5 November alleged hacking incidents. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedBataan provincial government websiteFull story | 5 Nov 2026 | Government | Defacement | None | Claimed. Monitors reported a defacement of a Bataan government website. | Newsbytes.PH · Astig.ph✓ 7 Nov |
 ⚠️ ClaimedPhilippine Nurses AssociationFull story | 5 Nov 2026 | Health | Defacement | Claimed. The association's website was defaced with a Nullsec Philippines message. | Philstar Tech · Newsbytes.PH✓ 7 Nov | |
| ⚠️ ClaimedAlliance Graduate SchoolFull story | 5 Nov 2026 | Education | Defacement | None | Claimed. Monitors reported a defacement of the school's website. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedDepartment of Science and Technology (DOST) websiteFull story | 5 Nov 2026 | Government | DDoS | None | Claimed. Reports described a DDoS attack that left the DOST website inaccessible for several hours; the cause was not confirmed. | Philstar Tech · Bilyonaryo✓ 7 Nov |
 ⚠️ ClaimedLight Rail Manila (LRT-1) | 30 Oct 2026 | Transport | Ransomware | Claimed. Listed on Qilin's leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedSt. Luke's Medical CenterVia a vendor | 30 Oct 2026 | Health | Data leak | None | Confirmed. St. Luke's said on 30 October that someone gained unauthorized access to a third-party managed platform behind its mobile app, and the NPC confirmed it received the breach notification the same day. | GMA News · Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedKTU Shipyard | 30 Oct 2026 | Manufacturing | Ransomware | Claimed. Whitearmor listed KTU Shipyard on its leak site on 30 October. | Ransomware.live (Philippines)✓ 7 Nov | |
 ✅ ConfirmedDepartment of Migrant Workers (DMW) | 29 Oct 2026 | Government | Data leak | None | Confirmed. The privacy commission is investigating with the DMW. Claimed. Researchers say 27 database backups (about 68.8 GiB) tied to DMW portals were copied on 6 Sep; contents unverified. | Newsbytes.PH · Dark Reading✓ 7 Nov |
| ✅ ConfirmedDICT | 2 Oct 2026 | Government | Defacement | Confirmed. DICT acknowledged unauthorised access and defacement of a website staging environment. Claimed. 4HMDOS4 claimed the defacement. | Newsbytes.PH✓ 7 Nov | |
| ⚠️ ClaimedDICT Trusted Assessment Provider (D-TAP) filesVia a vendor | 24 Sep 2026 | Government | Data leak | Claimed. core849 claimed 410 files tied to 48 accredited cybersecurity firms; DICT said on 25 September that NCERT was verifying a possible exposure involving a D-TAP provider. | Astig.ph✓ 7 Nov | |
 ✅ ConfirmedLand Transportation Franchising and Regulatory Board (LTFRB) | 19 Sep 2026 | Transport | Data leak | Confirmed. The LTFRB confirmed a data breach in a public advisory and took its LTFRB Electronic Support System offline. Claimed. A user called core849 claimed 7.7 GB of personnel, vehicle registration and franchise records. | Newsbytes.PH✓ 7 Nov | |
 ⚠️ ClaimedGeneral Santos Doctors Hospital | 10 Sep 2026 | Health | Ransomware | Claimed. Listed on Rhysida's leak site. | ransomware.live✓ 7 Nov | |
 ✅ ConfirmedDepartment of Labor and Employment (DOLE) web host | 7 Sep 2026 | Government | Defacement | None | Confirmed. DICT said a DOLE web host was modified without authorization, the node was isolated, and no sensitive databases or personal data were compromised. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedPhilippine Ports Authority | 5 Sep 2026 | Transport | Ransomware | Claimed. Listed on Qilin's leak site; not confirmed by the PPA. | ransomware.live✓ 7 Nov | |
| ⚠️ ClaimedPhilippine Nuclear Research Institute and a naval shipbuilder | 27 Aug 2026 | Government | Intrusion | Claimed. Hunt.io found an attacker server holding reactor, fuel and staff records taken through an ownCloud flaw, plus 195 MB from a Navy-linked shipbuilder. | Cybersecurity News · SC Media✓ 7 Nov | |
 ⚠️ ClaimedGlobalport Terminals | 27 Aug 2026 | Transport | Ransomware | Claimed. Qilin listed Globalport Terminals on its leak site on 27 August. | Ransomware.live (Philippines)✓ 7 Nov | |
| ⚠️ ClaimedLifeBank Microfinance Foundation | 22 Aug 2026 | Finance | Ransomware | Claimed. Coinbase Cartel listed LifeBank Microfinance Foundation on its leak site on 22 August. | Ransomware.live (Philippines)✓ 7 Nov | |
 ⚠️ ClaimedMegawide Construction | 16 Aug 2026 | Property | Ransomware | Claimed. Qilin listed Megawide on its leak site on 16 August. | Ransomware.live (Philippines) · DeXpose✓ 7 Nov | |
 ⚠️ ClaimedCity Government of Baguio (BUILDPass) | 12 Aug 2026 | Government | Ransomware | Claimed. Emperador listed the city on 12 August claiming 2.9 GB of permits, IDs and blueprints; the city disabled its BUILDPass permit system. | Ransomware.live · BlackFog✓ 7 Nov | |
 ⚠️ ClaimedLT Group / Fortune Tobacco Corp | 10 Aug 2026 | Manufacturing | Ransomware | Claimed. Deadlock listed LT Group and Fortune Tobacco on its leak site on 10 August. | Ransomware.live (Philippines)✓ 7 Nov | |
 ✅ ConfirmedSenate of the Philippines | 10 Jun 2026 | Government | Defacement | Confirmed. The Senate EDP-MIS bureau confirmed the website defacement and said there was no indication confidential information was compromised. Claimed. Nullsec Philippines claimed the defacement in a Facebook post. | Philstar✓ 7 Nov | |
 ⚠️ ClaimedLiberty Insurance Corporation | 10 Jun 2026 | Finance | Ransomware | Claimed. Krybit listed libertyinsurance.com.ph on its leak site on 10 June. | Ransomware.live (Philippines)✓ 7 Nov | |
 ⚠️ ClaimedPanorama BPO | 1 Jun 2026 | Other | Ransomware | Claimed. DragonForce listed Panorama BPO on its leak site on 1 June. | Ransomware.live (Philippines)✓ 7 Nov | |
 ⚠️ ClaimedPhilex Mining | 30 Apr 2026 | Other | Ransomware | Claimed. Qilin listed Philex Mining on its leak site on 30 April. | Ransomware.live (Philippines)✓ 7 Nov | |
| ✅ ConfirmedPricon Microelectronics (Yamaichi Electronics) | 22 Apr 2026 | Manufacturing | Ransomware | Confirmed. Parent Yamaichi Electronics announced on 22 April that ransomware hit some servers at its Philippine subsidiary, confirmed on 17 April. Claimed. LockBit 5.0 listed pricon.com.ph on its leak site on 29 April and threatened to publish data. | ScanNetSecurity · DeXpose✓ 7 Nov | |
 ✅ ConfirmedCoral Bay Nickel Corporation (Sumitomo Metal Mining) | 8 Apr 2026 | Manufacturing | Ransomware | None | Confirmed. Parent Sumitomo Metal Mining announced on 8 April that two servers at its Philippine nickel subsidiary were encrypted on 2 April and that plant production continued. | ScanNetSecurity✓ 7 Nov |
 ⚠️ ClaimedDepartment of Public Works and Highways (DPWH) | 23 Mar 2026 | Government | Data leak | Claimed. Bashe (APT73) listed about 50 GB of DPWH files on its leak site; Secretary Vince Dizon said initial findings showed internal systems secure. | Daily Tribune · Ransomware.live (Philippines)✓ 7 Nov | |
 ⚠️ ClaimedeGov PH platformVia a vendor | 20 Mar 2026 | Government | Intrusion | None | Claimed. Online posts alleged unauthorized access to eGov PH; DICT said it found no verified breach of core infrastructure and linked the reports to isolated third-party components. | Newsbytes.PH✓ 7 Nov |
 ⚠️ ClaimedPhilippine Savings Bank (PSBank) | 28 Jan 2026 | Finance | Ransomware | Claimed. Qilin listed PSBank on its leak site on 28 January; The Gentlemen listed it again on 1 August. | Ransomware.live · Deep Web Konek✓ 7 Nov | |
| ⚠️ ClaimedLenotech Corporation | 27 Jan 2026 | Other | Ransomware | Claimed. Tengu listed lenotech.com.ph on its leak site on 27 January, reportedly with about 136 GB of data. | Ransomware.live (Philippines)✓ 7 Nov | |
 ⚠️ ClaimedDTI Foreign Trade Service Corps | 11 Jan 2026 | Government | Ransomware | Claimed. The Gentlemen listed the DTI Foreign Trade Service Corps on its leak site on 11 January. | Ransomware.live (Philippines)✓ 7 Nov |
FAQ
Does Philippines have a national cyber threat level?
No published national cyber threat level was found for The Philippines (checked 7 Nov 2026). DICT and CERT-PH issue advisories; the National Privacy Commission handles breach notifications.
Which organisations in Philippines confirmed cyber incidents recently?
9 incidents confirmed since January 2026: Bureau of Internal Revenue (BIR), St. Luke's Medical Center, Department of Migrant Workers (DMW), DICT, Land Transportation Franchising and Regulatory Board (LTFRB), Department of Labor and Employment (DOLE) web host, Senate of the Philippines, Pricon Microelectronics (Yamaichi Electronics) and Coral Bay Nickel Corporation (Sumitomo Metal Mining).
Which Philippines organisations appear on ransomware or leak sites?
35 claims, not confirmed by the organisations: Department of Transportation (DOTr) HRIS, Securities and Exchange Commission (SEC), Office of the Vice President, PhilJobNet (DOLE), Philippine Air Force, Philippine Coast Guard, Presidential Commission on Good Government (PCGG) and Department of Information and Communications Technology (DICT) internal files and others.
What counts as a confirmed incident?
The organisation, a regulator, the police or a minister has said something happened, as reported by a named outlet. Everything else is listed as claimed.
Why list leak-site claims at all?
Ransomware and extortion crews post victims on leak sites before anyone confirms. The list shows what attackers say. Treat it as a lead and check with the organisation.
Is the map a live attack feed?
No. It counts incidents and claims reported in 2026. Live attack maps from security vendors show scanning traffic hitting their sensors, which does not mean a place was attacked.
How often is it updated?
By hand when a national level changes or a notable incident is reported. The date is shown in the header.
Sources: official statements and regional press, including Bernama, The Star, Malay Mail, CNN Indonesia and Newsbytes.PH; leak-site claims from public ransomware trackers. Each entry links its source.