The National Privacy Commission (NPC) will coordinate with government agencies named in reports of alleged data leaks on Nov. 5 to determine whether personal information was compromised, saying it had received no breach notifications from the concerned institutions as of Nov. 6, 2026.
In a statement issued Friday, NPC Spokesperson and Deputy Privacy Commissioner Atty. Jose Belarmino II said the commission was aware of reports involving several government agencies but had yet to receive formal personal data breach notifications concerning the incidents.
The reports, circulated by cybersecurity monitoring page Deep Web Konek and posted on underground cybercrime forums, involved alleged data exposure affecting the Department of Information and Communications Technology (DICT), Office of the Vice President, Presidential Commission on Good Government, Philippine Air Force, PhilJobNet and Eastern Visayas State University. The Philippine Nurses Association website was also reportedly defaced.
The allegations included claims of stolen government documents, exposed personnel records and personal information, as well as unauthorized access to institutional systems. The reported volumes ranged from several gigabytes of files to millions of purported records. These claims have not been independently verified.
The NPC said it would contact the agencies directly to verify the reported incidents, establish the circumstances surrounding them and determine whether personal data had been compromised.
Where warranted, the commission will require the agencies to submit the necessary reports and comply with their obligations under the Data Privacy Act of 2012 and applicable NPC regulations.
Under NPC Circular No. 16-03, personal information controllers are required to notify the commission and affected data subjects within 72 hours upon knowledge of, or reasonable belief that, a personal data breach requiring mandatory notification has occurred.
The commission said that if the reported incidents are confirmed and meet the requirements for mandatory notification, the concerned agencies must submit the prescribed breach notifications in accordance with existing regulations.
However, the NPC cautioned against treating the online claims as proof of a confirmed data breach or a violation of the Data Privacy Act.
“Reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the provisions of the Data Privacy Act of 2012 have been violated,” the commission said.
It added that determining whether a breach occurred requires an assessment of the facts and circumstances surrounding each incident.
The NPC said it would continue monitoring developments and take appropriate regulatory action when warranted to protect personal information and uphold the rights of data subjects. Further information will be released as developments warrant.
The reported incidents surfaced on Nov. 5, coinciding with Guy Fawkes Day and the annual Million Mask March, which has become associated with hacktivist groups using the Guy Fawkes mask as a symbol of protest. Some of the forum posts invoked the date and carried political messages, although the timing does not establish that the incidents were coordinated.
As of the NPC’s Nov. 6 statement, the commission had not confirmed the alleged breaches.
Full disclosure: All news articles published on the TechSabado website are written by human journalists, unless otherwise specified. Final text editing is also performed by human editors, with artificial intelligence (AI) used only to assist with additional grammar and style guide corrections..
————————————————————————-
TEN YEARS OF TECHSABADO!
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE & SPOTIFY channels.
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WE ARE ALSO ON SPOTIFY
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
Leave a Reply