A series of alleged cyberattacks and data leaks targeting Philippine government agencies and public institutions surfaced on underground cybercrime forums on Nov. 5, with threat actors invoking Guy Fawkes Day and the annual Million Mask March to frame their activities as hacktivism.
The incidents, reported by cybersecurity monitoring page Deep Web Konek, involved the Department of Information and Communications Technology (DICT), the Office of the Vice President (OVP), the Presidential Commission on Good Government (PCGG), the Philippine Air Force (PAF), PhilJobNet and Eastern Visayas State University (EVSU). The Philippine Nurses Association (PNA) website was also reportedly defaced.
The claims included alleged theft of internal documents, exposure of personal information and unauthorized access to institutional systems. The reported data volumes ranged from several gigabytes to millions of purported records, although the claims have not been independently verified.
In one listing, a threat actor using the forum account “core849” advertised 3.6GB of documents allegedly taken from DICT. The post, titled “Philippines DICT Internal Documents (3.6GB),” reportedly included procurement records, budget information and administrative files.
One sample was identified as a market research and price analysis document for the procurement of an Active Cellular Identification and Cybersecurity System for ASEAN 2026. It showed an estimated approved budget for the contract of P160 million.
DeathNoteHackers, using the account name “DNH@PH,” separately claimed to have obtained about 10GB of files from the OVP scheduler system, identified as ovp.scheduler.ph. Its post opened with the statement, “This is not budgeting. This is a licensed, executive-stamped heist written straight into law,” before making allegations about government spending and budget allocations. Those political accusations remain unsubstantiated.
The same threat actor advertised an alleged 11GB collection from the PAF Command Clearance System. The listing, titled “PHILIPPINE AIR FORCE (COMMAND CLEARANCE SYSTEM),” claimed the files included personnel documents, birth certificates, government-issued identification cards, marriage certificates, command orders and Statements of Assets, Liabilities and Net Worth.
DNH also claimed that PhilJobNet, the government’s employment portal associated with the Department of Labor and Employment, had exposed about 19.2 million records. The alleged 5.74GB dataset reportedly contained names, contact details, residential addresses and Taxpayer Identification Numbers.
Happy Go Lucky PH, meanwhile, claimed to have compromised the PCGG and exfiltrated about 8GB of internal documents, employee information and Google Storage contents. The group alleged that its initial access involved a DICT staging server. That claimed connection has not been independently established.
EVSU’s Human Resource Management Information System also figured in a post attributed to DNH-affiliated actors. The group said it had decided against publicly releasing the materials after a student contacted it, opting instead to flag security weaknesses. Its post warned that the university’s “HRMIS system still needs a serious security review.”
The PNA website reportedly displayed a defacement message identifying the perpetrators as Nullsec Philippines. The page carried the declaration, “Hacked by Nullsec Philippines!” and included references to DeathNote Hackers and Anonymous Philippines. The vulnerability exploited and whether information was accessed or exfiltrated remain unknown.
Nov. 5 is significant in hacktivist circles because it marks Guy Fawkes Day, commemorating the failed 1605 Gunpowder Plot against England’s Parliament. The Guy Fawkes mask, popularized by the graphic novel and film V for Vendetta, became associated with Anonymous and protest movements. The Million Mask March uses the imagery to express opposition to corruption, surveillance and abuses of power.
The date’s symbolism provides an occasion for groups to publicize political messages and alleged cyber operations. However, the timing does not establish that the incidents were coordinated or that the groups involved belong to the same network.
As of writing, the DICT and the Cybercrime Investigation and Coordinating Center had issued no statement specifically addressing the reported incidents. The alleged breaches and data exposures require independent technical validation.
Full disclosure: All news articles published on the TechSabado website are written by human journalists, unless otherwise specified. Final text editing is also performed by human editors, with artificial intelligence (AI) used only to assist with additional grammar and style guide corrections..
————————————————————————-
TEN YEARS OF TECHSABADO!
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE & SPOTIFY channels.
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WE ARE ALSO ON SPOTIFY
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
Leave a Reply