Philippine organizations faced more than 9 million compromised credentials, 10,913 phishing attacks and 83 data breach incidents in the third quarter of 2026, as cybercriminals increasingly targeted government agencies, financial institutions and businesses, according to a report by Viettel Cyber Security.
The Cyber Threat Landscape in the Philippines Q3 2026 report, covering July to September, said the 83 data breach incidents exposed more than 85.9 million records, while ransomware attacks rose to 19 from five in the same period last year.
The findings point to a threat environment in which stolen credentials, phishing campaigns and attacks on vulnerable systems are being used to gain access to organizational networks and sensitive information. The report also identified the growing use of artificial intelligence in impersonation scams and cyberattack operations.
Credential exposure remained a major concern. Viettel Threat Intelligence recorded 9,032,508 compromised credentials linked to Philippine users in Q3, more than double the 4.3 million recorded in the same quarter of 2025 and slightly above the 8.86 million reported in Q2 2026.
The number of exposed credentials has remained above 8.8 million for three consecutive quarters. The report placed the 2026 year-to-date total at more than 28.3 million, nearly three times the 9.74 million recorded throughout 2025.
“Attackers today don’t need to break in when they can simply log in. With more than 9 million Philippine credentials compromised in a single quarter, a stolen password has become one of the cheapest ways into a company’s network,” said Thomas Luu, country manager of Viettel Cyber Security.
“The real question for business leaders is no longer whether their accounts have been exposed, but whether they would notice when someone else starts using them,” he said.
Phishing and impersonation campaigns expand
Phishing attacks reached 10,913 in Q3, a 43% increase from the same period in 2025. The report identified banking, financial services and insurance as the largest target category, accounting for 29% of recorded attacks. Government impersonation accounted for 24%, while social media-related threats represented 16%.
Online services and e-commerce each accounted for 10% of the reported distribution, with the remaining 11% spread across other sectors.
Viettel said threat actors were using AI-generated images and videos to impersonate public figures and cybercrime authorities, making fraudulent messages and schemes more convincing. The campaigns also involved fake government social media accounts, SMS phishing and recruitment through Facebook and Telegram to funnel victims into offshore scam compounds.
The report warned that AI-generated deepfakes could increasingly be used to impersonate bank personnel, government officials and cybercrime authorities. Fraud groups may use these identities to pressure victims into transferring money or paying for fraudulent fund-recovery services.
It also forecast more attempts to distribute phishing SMS through devices that imitate mobile network infrastructure, potentially bypassing conventional filtering systems.
The commercialization of stolen credentials is making these attacks easier to carry out. Under the Stealer-as-a-Service model, criminals can rent information-stealing tools and trade compromised credentials through underground forums and messaging channels. The stolen information can then be used for account takeovers, business email compromise and ransomware intrusions.
Data breaches expose millions of records
Viettel recorded 83 data breach incidents in the Philippines during Q3, up from 76 in the same quarter of 2025. The volume of exposed records increased 63% to more than 85.9 million.
July was the quarter’s most active month, with 47 incidents exposing 60.2 million records, or about 70% of the total. August and September each recorded 18 incidents.
Government entities accounted for 41% of the quarter’s data breaches, or 34 incidents, making the public sector the most frequently affected. Banking, financial services and insurance followed with 19%, or 16 incidents, while consumer services accounted for 16%, or 13 incidents.
The report cited several major incidents. Six online lending platforms experienced breaches involving about 32 million records, including names, contact details, dates of birth, addresses and account information. A separate incident affecting the transportation sector exposed 16 million records.
Other incidents involved public institutions and health care facilities. One public-sector breach exposed 103.2 gigabytes of data, including more than 140,000 scanned passports and identification documents. A separate ransomware incident involving a hospital affected 2.44 gigabytes of internal data comprising more than 3.5 million files.
The report said some attackers were also selling direct access to compromised networks, including privileged administrative, virtual private network and Active Directory credentials. In one case, a hacktivist group claimed to have remained inside a government agency’s Active Directory environment for more than a month before compromising a domain controller.
Viettel said the shift from stealing information to maintaining access inside networks increases the risk of further intrusions, data theft and disruption of critical systems.
Ransomware attacks nearly quadruple
Ransomware incidents increased to 19 in Q3 from five a year earlier. The report identified manufacturing and transportation as the sectors with the most recorded incidents, with three each. Hospitality and tourism, business services, health care and financial services recorded two incidents apiece.
Other affected sectors included logistics, real estate and office rental, professional services, government and defense, and other industries.
The attacks involved multiple groups, including Qilin, The Gentlemen, INC, Rhysida and others. Viettel said ransomware operators continued to use double extortion, stealing data before encrypting systems and threatening to publish the information if victims did not pay.
The report’s incident briefs also documented attacks against public and health care organizations in August and September. These included the encryption of a 62.5-gigabyte city citizen identification database and the theft or encryption of hospital information.
Vulnerabilities and supply chains remain exposed
The report counted 34,223 newly emerged vulnerabilities in Q3, nearly three times the 9,277 recorded in the same quarter of 2025. Critical and high-severity vulnerabilities represented more than half of the total.
Viettel said the increase may partly reflect the wider use of AI-assisted tools in source code reviews and vulnerability discovery, which can reduce detection time and improve research productivity.
However, the report noted that actual attack campaigns continued to exploit older vulnerabilities, including those affecting Apache Log4j, Fortinet FortiNAC, SolarWinds Orion, Atlassian Confluence and F5 BIG-IP systems. This suggests that outdated systems and delayed patching remain significant security risks.
Supply chain attacks also targeted open-source repositories, developer accounts and software development pipelines. Malicious packages distributed through platforms such as npm and PyPI were used to steal environment variables, SSH keys, cloud authentication information and other credentials.
Viettel also identified advanced persistent threat groups using phishing attachments, malicious links and compromised software packages to maintain access to targeted networks. AI was increasingly being used across stages of these operations, including reconnaissance, phishing, malware modification and data collection.
Companies urged to strengthen account security
Viettel recommended that organizations strengthen account protection through phishing-resistant multifactor authentication, stricter access controls and continuous monitoring of privileged accounts. It also advised businesses to apply software updates promptly, maintain regular backups and establish incident response and disaster recovery plans.
The report further recommended zero-trust security models, privileged access management and regular threat hunting. Organizations using internal AI systems should also establish controls to prevent sensitive information from being exposed through prompts or retrieved data.
Luu said businesses should treat cybersecurity as a leadership responsibility rather than a problem addressed only after an incident.
“What we often see on the ground is that organizations only discover an attack after the damage is done. Going into 2027, the businesses that stay ahead will be those that treat cybersecurity as a leadership priority reviewed regularly, not an IT problem fixed after an incident,” he said.
“Knowing where you are exposed before attackers do is now a basic business requirement,” Luu added.
The report’s outlook for the coming months includes more sophisticated hacktivist intrusions, AI-driven impersonation and attacks that exploit weaknesses in telecommunications infrastructure. It also expects scam networks operating across the region to continue recruiting Filipinos through fraudulent customer service and technology job offers.
Viettel said organizations would need to move beyond reactive defenses and improve their ability to identify threats before attackers gain persistent access to their systems.
Full disclosure: All news articles published on the TechSabado website are written by human journalists, unless otherwise specified. Final text editing is also performed by human editors, with artificial intelligence (AI) used only to assist with additional grammar and style guide corrections..
————————————————————————-
TEN YEARS OF TECHSABADO!
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE & SPOTIFY channels.
WATCH TECHSABADO ON OUR YOUTUBE CHANNEL:
WE ARE ALSO ON SPOTIFY
WATCH OUR OTHER YOUTUBE CHANNELS:
PLEASE LIKE our FACEBOOK PAGE and SUBSCRIBE to OUR YOUTUBE CHANNEL.
Leave a Reply