A cybersecurity research firm has found evidence that an operator copied nearly 69GB of database backups linked to the Philippine government’s overseas employment systems, prompting the National Privacy Commission (NPC) to investigate possible violations of the Data Privacy Act of 2012.
NPC spokesperson Roren Chin said the commission is investigating the incident and coordinating with the Department of Migrant Workers (DMW).
“The National Privacy Commission (NPC) is aware of the matter and is conducting an investigation to assess the facts and circumstances of the incident and determine whether any violations of the Data Privacy Act (DPA) of 2012 have occurred,” Chin said.
“The Commission is likewise coordinating closely with the DMW to ensure that any data privacy concerns are appropriately addressed and that the rights and interests of data subjects are safeguarded in accordance with the law,” the spokesperson added.
The investigation follows an Oct. 28 report by Hunt.io, which said it recovered transfer logs showing that 27 Microsoft SQL Server backup files, totaling 68.837 GiB, were copied on Sept. 6, 2026, in less than 24 minutes.
The filenames included references to the Philippine Overseas Employment Administration (POEA) and overseas Filipino worker (OFW) systems. The POEA’s functions have since been integrated into the DMW.
Hunt.io traced two servers involved in subsequent file retrievals to government portal domains under dmw\.gov.ph, including apps.dmw\.gov.ph and legalassistance.dmw\.gov.ph.
The findings linked the activity to the agency’s infrastructure but did not establish what happened to the files after they were copied.
The firm said it notified the relevant national computer emergency response team before publishing its findings.
Hunt.io discovered the evidence on a server hosted by UpCloud in Singapore that exposed a working directory through an unauthenticated HTTP service.
The directory contained transfer and access logs, malicious software components, a PowerShell script, and tools used to interact with Windows network environments.
According to the recovered transfer log, the operator copied all 27 backup files in 23 minutes and 46 seconds. The logs also showed that the operator retrieved additional tools from the exposed server later that day.
Hunt.io said the timing indicated that the database backups had already been copied before the recovered malicious payloads were downloaded. However, the available evidence did not establish whether the payloads were executed on government systems.
The report also did not identify how the operator initially gained access to the databases or where the backup files were ultimately stored.
Although the filenames point to overseas employment and migrant worker databases, Hunt.io did not verify the contents of the backups or establish whether personal information was accessed by unauthorized parties.
The exposed directory recorded 543 requests from 76 distinct IP addresses over more than 16 hours on Sept. 6 and 7. Hunt.io cautioned that requests to an open directory do not necessarily indicate involvement in the operation.
The researchers also identified files associated with a modified version of GodPotato, a publicly available tool that can exploit certain Windows service-account privileges to obtain SYSTEM-level access. The directory contained Impacket, a toolkit used to interact with Windows network protocols.
Hunt.io said the recovered evidence did not reveal a confirmed initial access method, a command-and-control channel, or proof that the payloads had executed.
The NPC’s investigation is expected to establish the circumstances of the incident and determine whether the handling of personal data violated the country’s data protection law.
The DMW and the Department of Information and Communications Technology have yet to publicly establish the full extent of the alleged data theft in the findings cited in the report.
