The Securities and Exchange Commission of the Philippines (SEC) has disclosed that a data security incident was uncovered on November 6 and that the matter has been reported to the National Privacy Commission (NPC).

In its statement, the regulator confirmed that company records, passwords, and databases remained unaffected by the incident, although some individual account information may have been compromised.

What the SEC says it found

The SEC has found no evidence of compromised passwords, tampered data, or impacted company records. Its advisory nevertheless cautioned that names, usernames, contact details, birth dates, addresses, and taxpayer identification may have been exposed.

Authorities are investigating the origin and legitimacy of the data in question. The SEC said it has stepped up precautions and launched an inquiry to establish whether the reported information is genuine, noting that the source could be malware while stopping short of identifying a cause for the incident.

The disclosure followed a November 5 report by Deep Web Konek, a Philippine-based cybersecurity advocacy group, which flagged a forum listing offering for sale 487,000 lines of alleged SEC information.

BIR probes a 340,000-line leak claim

The Bureau of Internal Revenue (BIR) is investigating a separate claim with the Cybercrime Investigation and Coordinating Center and the national computer emergency response team, the Philippine News Agency reported. A second forum advertisement claimed to offer 340,000 lines of BIR data. The BIR has not confirmed any theft of taxpayer data; the probe's findings will determine whether the advertised 340,000 lines correspond to an actual theft.

The SEC and BIR listings share one detail: both appeared on November 5 via an account called "sinigangmixwithgabi." Because the claims originate from the same account, neither can independently corroborate the other, and the figures of 487,000 and 340,000 lines give no indication of how many people were affected. The data behind the claims has not been independently verified.

The privacy regulator's 72-hour clock

According to the NPC, no breach notifications were received regarding the alleged government leaks as of November 6. The SEC, for its part, stated that it had informed the commission of the situation — two accounts of events issued at different times.

The NPC's 72-hour rule takes effect when an agency has knowledge of, or reasonable grounds to believe, that a breach requiring notification has occurred, at which point the regulator and affected parties must be notified. An online allegation, on its own, does not constitute such a breach. Whether the clock is running therefore hinges on what the SEC's inquiry establishes about the data's authenticity, and on how the differing accounts of the notification are reconciled.

A pattern that predates this week

Hunt.io traced the September 6 copying of 68.837 GiB from 27 SQL Server backups with filenames matching Philippine migrant-worker systems, although the firm could not establish how access began or whether malware ran.

Verizon examined more than 22,000 confirmed breaches worldwide in its 2026 report, including 2,410 public-administration cases involving disclosed data. IBM put average ASEAN breach costs at US$4.12 million, or US$6.53 million for financial services — neither figure is a Philippine loss estimate.

Why repeated leaks dent digital-government trust

For users of government portals, potentially exposed personal profiles raise the risk of targeted scams, even where corporate data remains secure. The immediate task is confirming whether the advertised records are genuine — with the SEC's inquiry, the BIR-led probe, and any change in the NPC's notification log serving as the markers to watch.

Cyberattacks can also carry broader financial consequences. The IMF warns that attacks on critical financial systems can disrupt services and undermine market confidence. So far, however, there is no established market impact from the Philippine incidents.

France offers a clearer example of confirmed data theft: its tax authority acknowledged that taxpayer records were stolen, as Cryptopolitan reported. In the Philippines, the SEC has confirmed a security incident — but neither the SEC nor the BIR has verified the amounts of data advertised online.

Source: Cryptopolitan