Philippine SEC breach puts 487K-record leak claim under scrutiny

The Securities and Exchange Commission of the Philippines (SEC) has disclosed that an incident concerning a breach of data security was uncovered on November 6. They have reported the incident to the National Privacy Commission (NPC).

In their statement, the SEC confirmed that company records, passwords, as well as databases remained unaffected by the incident. However, some individual account information might have been compromised.

What the SEC says it found

The SEC has not found any evidence of compromised passwords, tampered data, or impacted company records. However, its advisory said names, usernames, contact details, birth dates, addresses, and taxpayer identification may have been exposed.

Authorities are currently investigating the source of the data in question and its legitimacy. The SEC has stepped up precautions and launched an investigation to clarify the legitimacy of the reported information. The agency has also noted the possibility that the source of the data may be malware but has not been able to state the cause of the incident.

In the meantime, Deep Web Konek, a Philippine-based cybersecurity advocacy group, reported on November 5 that there is a forum entry offered for the sale of 487,000 lines of alleged information from the SEC.

BIR probes a 340,000-line leak claim

The Bureau of Internal Revenue (BIR) is investigating a separate claim with the Cybercrime Investigation and Coordinating Center and the national computer emergency response team, the Philippine News Agency reported. It has not confirmed any theft of taxpayer data.

A second forum advertisement claimed to offer 340,000 lines of BIR data.

The SEC and BIR forum lists have one similarity. Both of them appeared on November 5 via the account called “sinigangmixwithgabi.” Since the claims were made by the same account, it would therefore be impossible for one to confirm the other independently. The figures of 487,000 and 340,000 lines also give no idea about how many people were affected. The data that lies behind the claims have not been verified independently for the purposes of this article.

The privacy regulator’s 72-hour clock

According to the NPC, no breach notifications were received regarding the alleged government leaks as of November 6. The SEC stated that it had informed the NPC regarding the situation. These two accounts of events were given at different times.

The NPC’s 72-hour rule kicks in when an agency has knowledge or reasonable grounds for believing that a breach that requires notification has occurred. Then the agency and affected parties must be notified. An online allegation does not constitute such a breach on its own.

A pattern that predates this week

Hunt.io traced the September 6 copying of 68.837 GiB from 27 SQL Server backups with filenames matching Philippine migrant-worker systems. The firm could not establish how access began or whether malware ran.

Verizon examined more than 22,000 confirmed breaches worldwide in its 2026 report, including 2,410 public-administration cases involving disclosed data. IBM put average ASEAN breach costs at US$4.12 million, or US$6.53 million for financial services. Neither is a Philippine loss estimate.

Why repeated leaks dent digital-government trust

For government portal users, potentially exposed profiles raise risks of targeted scams, even if corporate data remains secure. What matters now is confirming whether the advertised records are genuine.

Cyberattacks can have wider financial consequences. The IMF warns that attacks on critical financial systems can disrupt services and undermine market confidence. So far, however, there is no established market impact from the Philippine incidents.

France offers a clearer example of confirmed data theft. Its tax authority acknowledged that taxpayer records were stolen, as Cryptopolitan reported. In the Philippines, the SEC has confirmed a security incident, but neither the SEC nor BIR has verified the amounts of data advertised online.