SEC confirms data breach on its digital platforms

MANILA, Philippines — The Securities and Exchange Commission (SEC) has confirmed a data breach on users of its digital platforms.

In an advisory, the SEC said the accounts of its digital platform users “may have been leaked potentially through malware infection or unauthorized access by a third-party threat actor of your laptop, desktop, mobile phone or any other device you used to access our digital platforms.”

The agency did not provide any information as to how it ascertained the potential source of the issue.

It sent the notice to affected users days after cybersecurity advocacy group Deep Web Konek flagged a possible data breach involving SEC-related user accounts.

Last week, the SEC said it is treating the claims “with utmost urgency and importance.”

“The SEC is conducting a thorough investigation of the matter and enforcing enhanced security measures together with heightened monitoring of its systems,” it added.

The agency has yet to release the total number of affected users and maintained that no passwords in its databases were leaked or that no data was modified or altered in any way.

It said that no company records were involved in the issue.

“The categories of potential information that may have been exposed are strictly limited to: full name, username, email address, mobile number, date of birth, gender, address and TIN (tax identification number) of your individual account,” the advisory said.

Upon discovering the issue, the SEC said its technical response teams immediately initiated containment and preventive protocols, including formally notifying the National Privacy Commission.

It said “comprehensive security scans and log analyses were also initiated across all digital infrastructure to determine if any internal system showed signs of unauthorized access.”

“We further reinforced access controls, updated authentication credentials and verified data integrity to ensure no data modification occurred and corporate data assets remain secure,” it added.

The SEC advised affected users to implement security measures, including changing passwords and running a full security scan on personal devices.

“Be cautious of unexpected emails, calls or text messages asking for your personal or account information. The SEC will never ask for your passwords or security PINs,” it said. — Richmond Mercurio