Philippines Cyber Watchhttps://pwnsy.com/tools/cyber-watch/philippines/Sourced cyber incidents and official statements, from pwnsy Cyber Watch.enSun, 08 Nov 2026 00:00:00 +0000Bureau of Internal Revenue (BIR): Data leak (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#allf633434e5f83d293Sat, 07 Nov 2026 00:00:00 +0000BIR is investigating an alleged leak of its data with DICT, NCERT, CICC and the PNP Anti-Cybercrime Group. Posts online allege BIR data was leaked; extent not stated. Sources: https://www.gmanetwork.com/news/topstories/nation/1008620/bir-data-leak-under-gov-t-probe/story/Philippines statement: PNP reported eight cybercrime convictions and 144 referred cases for October.https://tribune.net.ph/2026/11/07/pnp-records-eight-cybercrime-convictions-144-referred-cases-in-october8cfc441dfd36d157Sat, 07 Nov 2026 00:00:00 +0000PNP reported eight cybercrime convictions and 144 referred cases for October.Full story: Philippine agencies named in a wave of hack and leak claimshttps://pwnsy.com/tools/cyber-watch/incidents/philippines-government-leak-claims-november-2026/f0bc1b2aa090bf9bSat, 07 Nov 2026 00:00:00 +0000On 5 and 6 November 2026 hackers claimed leaks from the OVP, PhilJobNet, PAF, PCG, DICT, DOTr, SEC, BIR and others. Most claims are unverified.Department of Transportation (DOTr) HRIS: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all41a7152d5bcdc002Fri, 06 Nov 2026 00:00:00 +0000A forum user claimed payroll, attendance and biometric records for about 4,534 DOTr employees plus HRIS source code. Sources: https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/, https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/, https://hacknotice.com/2026/11/06/philippines-dotr-hris-complete-personnel-payroll-data-employee-pii-biometrics-s/Securities and Exchange Commission (SEC): Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#allff04f82c2205eb32Fri, 06 Nov 2026 00:00:00 +0000A forum user claimed files from the SEC. Sources: https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/Philippines statement: The privacy commission will verify reported 5 Nov leaks at several agencies and reminds them of the 72-hour nohttps://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/12ffa032dc1fe346Fri, 06 Nov 2026 00:00:00 +0000The privacy commission will verify reported 5 Nov leaks at several agencies and reminds them of the 72-hour notification rule.Philippines statement: NPC said it had received no breach notifications from agencies named in the 5 November leak claims and would vhttps://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/889fd9abddc238f5Fri, 06 Nov 2026 00:00:00 +0000NPC said it had received no breach notifications from agencies named in the 5 November leak claims and would verify them.Office of the Vice President: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#allbf97730f94bd5b7bThu, 05 Nov 2026 00:00:00 +0000The OVP says the scheduling platform is run by a third party and holds no classified files, without confirming or denying a breach. DeathNoteHackers claims about 10 GB of documents from the platform. Sources: https://politiko.com.ph/hack-or-political-attack-sara-dutertes-ovp-cries-smear-over-alleged-data-leak/PhilJobNet (DOLE): Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#allfeed650c62675a27Thu, 05 Nov 2026 00:00:00 +0000DeathNote Hackers claims about 19.2 million records from the government job portal. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/Philippine Air Force: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all2a72ca6512168e58Thu, 05 Nov 2026 00:00:00 +0000A forum user claims about 11 GB of files including personnel records and ID copies. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/Philippine Coast Guard: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#alle93f7b15bf20247bThu, 05 Nov 2026 00:00:00 +0000DeathNoteHackers claimed about 1.35 GB across 6,698 files, including personnel and rescue records. Sources: https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/, https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/Presidential Commission on Good Government (PCGG): Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all52b69b579f440b73Thu, 05 Nov 2026 00:00:00 +0000HappyGoLuckyPH claimed about 8 GB of PCGG data. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/, https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/Department of Information and Communications Technology (DICT) internal files: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all1a06cdce597914d5Thu, 05 Nov 2026 00:00:00 +0000A forum user claimed about 3.6 GB of internal DICT documents, including procurement and budget records. Bilyonaryo News Channel, citing a source, reports the intrusion hit DocTracks, the internal document-routing system; DICT has not commented. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/, https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/, https://bnc.bilyonaryo.com/even-dict-isnt-safe-hackers-allegedly-breach-agencys-internal-document-system/business/Nueva Ecija University of Science and Technology (NEUST): Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#alla9ea1562b9496821Thu, 05 Nov 2026 00:00:00 +0000A forum user claimed personal and academic data on more than 81,000 NEUST students. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/DILG Local Government Unit Support System: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#alldebf4510883634caThu, 05 Nov 2026 00:00:00 +0000HappyGoLuckyPH claimed a breach of the DILG LGU support system. Sources: https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/Philippine Amusement and Gaming Corporation (PAGCOR): Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all0893ec12c5a98b70Thu, 05 Nov 2026 00:00:00 +0000A forum user claimed PAGCOR's National Database of Restricted Persons. Sources: https://radar.ph/govt-data-breach-claims-pile-up-npc-yet-to-receive-reports/Eastern Visayas State University: Intrusion (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#alleed8c6b600ad4547Thu, 05 Nov 2026 00:00:00 +0000Monitors listed the university among the 5 November alleged hacking incidents. Sources: https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/Bataan provincial government website: Defacement (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all1f7a8e488b533f05Thu, 05 Nov 2026 00:00:00 +0000Monitors reported a defacement of a Bataan government website. Sources: https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/, https://astig.ph/hacker-claims-dotr-payroll-biometric-data-4534-employees-2026/Philippine Nurses Association: Defacement (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all274af74f269cb4a9Thu, 05 Nov 2026 00:00:00 +0000The association's website was defaced with a Nullsec Philippines message. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/, https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/Alliance Graduate School: Defacement (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all632f990362eb8f7cThu, 05 Nov 2026 00:00:00 +0000Monitors reported a defacement of the school's website. Sources: https://newsbytes.ph/2026/11/06/npc-checking-data-leaks-following-nov-5-cyberattack-reports/Department of Science and Technology (DOST) website: DDoS (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all21f37cc0bde8e124Thu, 05 Nov 2026 00:00:00 +0000Reports described a DDoS attack that left the DOST website inaccessible for several hours; the cause was not confirmed. Sources: https://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/, https://bnc.bilyonaryo.com/even-dict-isnt-safe-hackers-allegedly-breach-agencys-internal-document-system/business/Light Rail Manila (LRT-1): Ransomware (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#allb11b278a3f38e2ffFri, 30 Oct 2026 00:00:00 +0000Listed on Qilin's leak site. Sources: https://www.ransomware.live/id/TGlnaHQgUmFpbCBNYW5pbGFAcWlsaW4St. Luke's Medical Center: Data leak (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#all491b7984b478def9Fri, 30 Oct 2026 00:00:00 +0000St. Luke's said on 30 October that someone gained unauthorized access to a third-party managed platform behind its mobile app, and the NPC confirmed it received the breach notification the same day. Sources: https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/, https://newsbytes.ph/2026/11/03/st-lukes-mobile-app-breach-may-have-exposed-patient-employee-data/KTU Shipyard: Ransomware (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all203b4655936884e3Fri, 30 Oct 2026 00:00:00 +0000Whitearmor listed KTU Shipyard on its leak site on 30 October. Sources: https://www.ransomware.live/map/PHPhilippines statement: NPC confirmed it received a personal data breach notification from St. Luke's Medical Center.https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/1a4605567f6c3c62Fri, 30 Oct 2026 00:00:00 +0000NPC confirmed it received a personal data breach notification from St. Luke's Medical Center.Department of Migrant Workers (DMW): Data leak (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#all19000090bb7afb06Thu, 29 Oct 2026 00:00:00 +0000The privacy commission is investigating with the DMW. Researchers say 27 database backups (about 68.8 GiB) tied to DMW portals were copied on 6 Sep; contents unverified. Sources: https://newsbytes.ph/?p=112671, https://darkreading.com/cyberattacks-data-breaches/philippine-migrant-worker-data-69gb-government-breachPhilippines statement: NTC ordered telcos to verify subscribers holding more than 100 SIMs within 15 days.https://www.manilatimes.net/2026/10/29/business/top-business/ntc-orders-checks-on-mobile-phone-subscribers-with-over-100-sim-cards/24567484d406ae5091ba0d8Thu, 29 Oct 2026 00:00:00 +0000NTC ordered telcos to verify subscribers holding more than 100 SIMs within 15 days.Philippines statement: DICT advised agencies to harden defenses around 5 November and said the advisory did not confirm an imminent ahttps://philstartech.com/news/2026/11/05/20296/philippines-nov-5-data-breach-government-agencies-2025/9b774c199f9f95a4Tue, 27 Oct 2026 00:00:00 +0000DICT advised agencies to harden defenses around 5 November and said the advisory did not confirm an imminent attack.Philippines statement: CERT-PH tells government and private organisations running PHP to patch PHP2Shell; no local compromise establihttps://newsbytes.ph/?p=1125741c94ee17c65de484Thu, 22 Oct 2026 00:00:00 +0000CERT-PH tells government and private organisations running PHP to patch PHP2Shell; no local compromise established.DICT: Defacement (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#all9c994cdb5be99a9eFri, 02 Oct 2026 00:00:00 +0000DICT acknowledged unauthorised access and defacement of a website staging environment. 4HMDOS4 claimed the defacement. Sources: https://newsbytes.ph/?p=112176Philippines statement: DICT said NCERT was handling a possible data exposure involving a D-TAP accredited provider.https://astig.ph/dict-dtap-data-exposure-410-files-48-firms-2026/4d20eee39d0b0d02Fri, 25 Sep 2026 00:00:00 +0000DICT said NCERT was handling a possible data exposure involving a D-TAP accredited provider.DICT Trusted Assessment Provider (D-TAP) files: Data leak (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all661d95f0c3890db9Thu, 24 Sep 2026 00:00:00 +0000core849 claimed 410 files tied to 48 accredited cybersecurity firms; DICT said on 25 September that NCERT was verifying a possible exposure involving a D-TAP provider. Sources: https://astig.ph/dict-dtap-data-exposure-410-files-48-firms-2026/Land Transportation Franchising and Regulatory Board (LTFRB): Data leak (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#all8a70443a3d3d96bdSat, 19 Sep 2026 00:00:00 +0000The LTFRB confirmed a data breach in a public advisory and took its LTFRB Electronic Support System offline. A user called core849 claimed 7.7 GB of personnel, vehicle registration and franchise records. Sources: https://newsbytes.ph/2026/09/19/ltfrb-confirms-data-breach-takes-records-system-offline/Philippines statement: LTFRB confirmed a data breach and took its Electronic Support System offline.https://newsbytes.ph/2026/09/19/ltfrb-confirms-data-breach-takes-records-system-offline/034038d64ead2495Sat, 19 Sep 2026 00:00:00 +0000LTFRB confirmed a data breach and took its Electronic Support System offline.General Santos Doctors Hospital: Ransomware (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all28f0a6d674460605Thu, 10 Sep 2026 00:00:00 +0000Listed on Rhysida's leak site. Sources: https://www.ransomware.live/id/R2VuZXJhbCBTYW50b3MgRG9jdG9ycyBIb3NwaXRhbEByaHlzaWRhPhilippines statement: DICT and CICC ordered agencies and critical infrastructure operators to complete 24-hour cyber readiness checkhttps://newsbytes.ph/2026/09/10/dict-cicc-order-24-hour-cyber-checks-after-attacks-on-govt-websites/a63c8d7965c0fd17Tue, 08 Sep 2026 00:00:00 +0000DICT and CICC ordered agencies and critical infrastructure operators to complete 24-hour cyber readiness checks.Department of Labor and Employment (DOLE) web host: Defacement (Confirmed)https://pwnsy.com/tools/cyber-watch/philippines/#all7516332311e6af68Mon, 07 Sep 2026 00:00:00 +0000DICT said a DOLE web host was modified without authorization, the node was isolated, and no sensitive databases or personal data were compromised. Sources: https://newsbytes.ph/2026/09/08/hackers-claim-access-to-dmw-network-as-dict-probes-govt-cyberattacks/Philippines statement: DICT said NCERT detected unauthorized access to the DMW website and that a PPA ransomware report was a false phttps://newsbytes.ph/2026/09/08/hackers-claim-access-to-dmw-network-as-dict-probes-govt-cyberattacks/ec0c58a62ce20ec8Mon, 07 Sep 2026 00:00:00 +0000DICT said NCERT detected unauthorized access to the DMW website and that a PPA ransomware report was a false positive.Philippine Ports Authority: Ransomware (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all7c7b5819668c2197Sat, 05 Sep 2026 00:00:00 +0000Listed on Qilin's leak site; not confirmed by the PPA. Sources: https://www.ransomware.live/id/UGhpbGlwcGluZSBQb3J0cyBBdXRob3JpdHlAcWlsaW4Philippine Nuclear Research Institute and a naval shipbuilder: Intrusion (Claimed)https://pwnsy.com/tools/cyber-watch/philippines/#all53f74edc95c697b1Thu, 27 Aug 2026 00:00:00 +0000Hunt.io found an attacker server holding reactor, fuel and staff records taken through an ownCloud flaw, plus 195 MB from a Navy-linked shipbuilder. Sources: https://cybersecuritynews.com/hackers-exploit-owncloud/, https://www.scworld.com/brief/suspected-chinese-actor-targets-philippine-nuclear-and-naval-entities-using-known-vulnerabilities