MANILA, Philippines — Cybersecurity monitoring group Deep Web Konek has flagged a massive wave of data breach and exposure incidents affecting 23 local institutions, including major national government agencies, law enforcement bodies, military systems and educational entities.
Based on an official intelligence assessment published by the group covering monitored underground disclosures from Nov. 5 to 7, the leaks involve millions of personal, corporate and administrative records, along with one website defacement event.
Among the prominent government offices listed in the disclosure report are the Office of the Vice President (OVP), Department of Information and Communications Technology, Bureau of Internal Revenue, Securities and Exchange Commission, Department of Labor and Employment (DOLE), Department of Transportation, Cybercrime Investigation and Coordinating Center (CICC), Presidential Commission on Good Government (PCGG), Philippine Coast Guard (PCG) and Land Transportation Office (LTO).
Threat actor attributions cited in the compilation include groups operating under names such as “DeathNote Hackers,” “Happy Go Lucky PH,” “sinigangmixwithgabi,” “core849” and “CrimsonSec Philippines.”
The breached data categories encompass personally identifiable information, government IDs, taxpayer and corporate registration details, employee and HR records, payroll data, student files and operational logs.
According to the report, DeathNote Hackers was able to access about 12,979 PDF files or about 10 gigabytes worth of information from the OVP on Nov. 5.
On the same day, the same group accessed 19.2 million records from DOLE worth about 5.74GB, internal reports and Commission on Audit files from the CICC and 6,698 files up to 1.35GB in size from the PCG.
Also on Nov. 5, Happy Go Lucky PH was able to net up to 8GB of internal files from the PCGG and up to 19 million resident profiles – or just under 500GB – from the Department of the Interior and Local Government and Barangay Central Database.
CrimsonSec Philippines, meanwhile, accessed 292,424 entries or just under 54.11GB of information from the LTO.
Educational institutions included in the summary are the University of Camarines Norte (UCN), Cavite State University-General Trias Campus (CSU-GTC), Nueva Ecija University of Science and Technology (NE-UST) and the University of St. La Salle (USLS).
At UCN, CrimsonSec Philippines and another group called GWAPINGS123 accessed the full academic and financial database of the school.
At CSU-GTC, 117,000-plus records were accessed by “blackhoundtht” and group known as “imken” accessed over 81,000 student records from NE-UST.
At USLS, 11,000-plus student profiles were accessed by group “pocherowithpetchay.”
Military and uniformed services were likewise tagged in the report, including internal document and record exposures affecting the Philippine Air Force.
Data exposures also extended to key public utility and private logistics firms, including the National Power Corporation, Mactan Electric Company and LBC Express, which allegedly suffered a compromise involving 20.9 million customer shipment logs.
Deep Web Konek warned the large-scale exposures of personal data heighten risks for targeted phishing attacks, text scams, unauthorized financial access and identity theft.
The entities mentioned are verifying the extent of the breach.