The National Privacy Commission (NPC) said it will verify reports of alleged data leaks involving several government agencies following a series of reported cyberattacks on November 5.
In a Nov. 6 statement, the NPC said it had yet to receive personal data breach notifications from the agencies concerned, according to spokesperson and deputy privacy commissioner Jose Belarmino II.
The commission said it would coordinate with the agencies to establish what happened and determine whether personal data had been compromised.
The statement followed social media posts by cybersecurity watchdog Deep Web Konek and civic technology group BetterGov.PH identifying several government systems as reportedly affected by hacking incidents.
The groups listed DICT Alagad, the Presidential Commission on Good Government, Eastern Visayas State University, the Vice President’s scheduling system, the Department of Labor and Employment’s Public Employment Service Office, the Department of Information and Communications Technology, and the Philippine Air Force’s clearance system as among those affected.
BetterGov.PH said a group calling itself DeathNoteHackers claimed responsibility for the incident involving the Vice President’s scheduling system. The claim remains unverified.
The groups also reported website defacements involving Bataan’s internal government website, the Philippine Nurses Association, Alliance Graduate School, and Luzviminda Construction and Development Corp.
The NPC cautioned that the reports alone do not establish that personal information was exposed or that a violation of the Data Privacy Act occurred.
“The Commission emphasizes that reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the provisions of the Data Privacy Act of 2012 have been violated. Such determinations require an assessment of the facts and circumstances surrounding each incident,” it said.
The commission said it would require the agencies to submit reports and comply with applicable privacy obligations where warranted.
Its statement cited NPC Circular No. 16-03, which requires personal information controllers to notify the commission and affected individuals within 72 hours upon knowledge of, or reasonable belief that, a breach requiring mandatory notification has occurred.
BetterGov.PH noted that the reported incidents coincided with the annual Million Mask March on Nov. 5, when protesters wear Guy Fawkes masks.
It said similar incidents involving Philippine websites had occurred around the same date in previous years, although no connection between the march and the latest reported attacks has been established.
