The Securities and Exchange Commission (SEC) has launched an investigation and a system-wide security audit after a data breach exposed personal information belonging to users registered on its digital platforms.

In a statement issued on Monday, the corporate regulator said its initial assessment found that no company records or stored passwords had been compromised and that the integrity of its internal systems remained intact.

“No passwords were leaked and no data was modified or altered in any way. The SEC assures the public that all internal database infrastructure and system integrity remain intact,” it said.

The breach involved personal information linked to registered users of the SEC’s digital platforms, including names, contact details, and other account information. The commission said it is still verifying the origin, scope, and validity of the affected records, and it has yet to disclose how many users were affected or where the breach originated.

The SEC is the Philippine government agency responsible for company registration and securities regulation, and its electronic platforms are used by businesses and individuals for filings and other transactions. That reliance makes the security of registered user data a concern that extends beyond the agency itself to the companies and professionals who transact with it.

The incident has also been reported to the National Privacy Commission — the government agency that enforces the Philippines’ Data Privacy Act and oversees compliance with breach-notification rules — according to reports on notifications sent to affected users.

The regulator said it immediately initiated containment and preventive measures upon discovering the incident, including security scans, checks for indicators of compromise, digital forensic examinations, and log analyses across its platforms.

“The SEC further reinforced access controls, updated authentication credentials, and verified data integrity to ensure no data modification occurred and corporate data assets remained secure,” it said.

The commission has additionally rolled out new safeguards and monitoring measures designed to detect suspicious activity and prevent unauthorized access to user accounts. Verification steps of this kind are a common response where contact details are exposed, since names and contact information can be used to craft phishing or impersonation attempts against account holders even when login credentials are untouched.

“The SEC continues to perform heightened monitoring to detect and block suspicious or unauthorized account activity across its services. The Commission has also implemented additional verification checks for account-related requests and security updates,” it said.

Until the SEC completes its verification of the affected records, the full scale and origin of the breach remain undetermined, leaving the results of the ongoing forensic work and investigation the key developments to watch.

— Ashley Erika O. Jose, BusinessWorld

Source: BusinessWorld