MANILA, Philippines — November 12, 2026 — Cybersecurity concerns are growing across the Philippine government after hackers claimed to have breached as many as 20 government agencies, prompting authorities to investigate whether sensitive public records were stolen, exposed or simply recycled from older data leaks.
Cybercrime Investigation and Coordinating Center (CICC) Executive Director Renato Paraiso disclosed the figure during a radio interview, explaining that investigators based the estimate on alleged hacking incidents in which threat actors posted purported stolen information as evidence.
But there is an important distinction: the CICC’s estimate of around 20 agencies refers to hacking claims, not 20 independently confirmed data breaches.
Meanwhile, the National Privacy Commission (NPC) has confirmed receiving formal personal-data breach notifications from 10 government agencies and institutions as of November 10.
Authorities are now examining the reported incidents, determining whether personal information was compromised and investigating who may be responsible.
The developments raise a pressing question for millions of Filipinos: Could information submitted to government offices—including taxpayer profiles, employment records and other personal details—fall into the hands of cybercriminals?
Why the CICC Is Investigating Around 20 Government Agencies
Paraiso said the estimate of approximately 20 agencies came from various alleged hacking incidents and the information threat actors claimed to have obtained.
Some hackers reportedly posted datasets or other materials online to support their claims.
However, investigators are checking whether the information is genuinely new or whether criminals are recycling previously exposed datasets to make it appear that they successfully breached government systems.
This distinction is critical.
A dataset appearing on an underground forum does not automatically prove that the organization named in the post was recently hacked. Investigators must establish where the information originated, whether unauthorized access actually occurred and whether the records are authentic.
Paraiso said authorities are also working to identify the individuals behind the alleged cyberattacks.
He added that vulnerabilities involving the Bureau of Internal Revenue (BIR) and Securities and Exchange Commission (SEC) had been contained and remediated, while investigations continued.
The CICC is coordinating with relevant government cybersecurity agencies as authorities assess the incidents.
NPC Confirms 10 Government Agencies Filed Breach Notifications
While the CICC is examining a wider list of alleged hacking incidents, the NPC has separately confirmed receiving personal-data breach notifications from 10 government agencies and institutions.
The list includes:
- Presidential Commission on Good Government (PCGG)
- Department of Information and Communications Technology (DICT)
- Department of Labor and Employment (DOLE), through its Bureau of Local Employment
- Bureau of Internal Revenue (BIR)
- Philippine Amusement and Gaming Corporation (PAGCOR)
- Department of Justice (DOJ), through its Office for Alternative Dispute Resolution
- Securities and Exchange Commission (SEC)
- Philippine Coast Guard (PCG)
- Department of Trade and Industry (DTI)
- Department of Science and Technology – Philippine Institute of Volcanology and Seismology (DOST-PHIVOLCS)
The NPC said each notification is being evaluated by its Compliance and Monitoring Division.
The assessment covers the circumstances of the reported incident, the possible impact on affected individuals and the measures taken by the agency concerned.
The division will prepare findings and recommendations for submission to the NPC Commission En Banc, which will determine the appropriate regulatory action.
The commission has not released a consolidated number of affected individuals or confirmed that all 10 incidents involved the same method of attack.
It is also important to understand that filing a breach notification is part of the regulatory process. It does not, by itself, establish the full extent of a breach or automatically prove legal liability.
BIR Says Some Taxpayer Profile Information May Have Been Exposed
One of the most significant developments involves the Bureau of Internal Revenue.
In an advisory dated November 10, the BIR acknowledged cybersecurity incidents reported on November 6 and 7 and said certain taxpayer profile information may have been exposed.
The agency said it immediately implemented measures to preserve evidence, prevent further exposure and determine the scope of the affected records.
However, the BIR also clarified that its initial findings showed no taxpayer information had been modified or lost.
It said records involving tax filing and payments were not compromised and that the integrity of its internal database infrastructure remained intact.
The BIR is conducting a forensic investigation with the CICC and the DICT’s National Computer Emergency Response Team (DICT-NCERT) to establish the source and extent of any unauthorized access.
The agency also confirmed that it had notified the NPC.
For taxpayers, the distinction matters: possible exposure of profile information is not the same as confirmation that tax returns, payment records or account balances were stolen or altered.
Still, exposed personal details could potentially be exploited in targeted phishing attempts, impersonation schemes and other fraudulent communications.
The BIR has advised taxpayers to:
- Update account passwords and credentials.
- Enable multi-factor authentication wherever available.
- Monitor accounts for suspicious activity.
- Remain cautious of phishing messages and fraudulent communications.
- Conduct transactions only through official BIR platforms and channels.
SEC Data Incident Raises Additional Privacy Concerns
The Securities and Exchange Commission is another institution included in the NPC’s list.
The SEC has separately issued an advisory concerning a security incident involving information associated with its digital platforms.
The wider concern is that information connected to online government services can include identifying and contact details that criminals may attempt to exploit.
However, the exact scope of the reported incidents must be assessed individually. A report involving an agency’s digital platform should not automatically be interpreted as proof that its entire database or all corporate records were stolen.
The NPC is reviewing the notifications and the agencies’ responses to determine the circumstances and potential impact.
Earlier Reports Included Alleged Leaks Beyond the 10 Agencies
The latest disclosures followed reports from Philippine cybersecurity monitoring group Deep Web Konek, which documented alleged data exposures involving as many as 23 local institutions between November 5 and 7.
The broader list reportedly included government offices, law enforcement and military-related organizations, educational institutions and private companies.
The reported categories of information included personal identification details, taxpayer and corporate registration records, employee and payroll information, student records and operational data.
However, the 23-institution monitoring report is a separate count from the NPC’s 10 formal notifications and the CICC’s estimate of around 20 agencies named in hacking claims.
These figures should not be combined as if they represent one verified list of successful cyberattacks.
The NPC has emphasized that reports of alleged data leaks do not, by themselves, establish that a personal-data breach occurred or that the Data Privacy Act was violated.
The commission must assess the evidence and circumstances surrounding each incident.
Why Old or Recycled Data Can Complicate Cybercrime Investigations
One issue investigators are examining is whether some hackers are presenting previously exposed information as newly stolen government data.
This tactic can make an old dataset appear to be evidence of a fresh attack.
For example, a threat actor might publish records obtained from an earlier incident and claim that they were taken from a government agency during a recent intrusion.
Without technical verification, the public may have difficulty distinguishing a genuine new breach from recycled information, fabricated claims or datasets whose origins remain unclear.
Investigators therefore need to establish the authenticity, source and date of the information, as well as whether unauthorized access to the named system actually occurred.
This is also why the CICC’s estimate should be treated as a count of alleged incidents under investigation—not a final tally of confirmed government breaches.
What the Data Privacy Act Requires From Government Agencies
The Philippines has an established legal framework for protecting personal information under Republic Act No. 10173, or the Data Privacy Act of 2012.
Under the law, personal information controllers and processors must implement reasonable and appropriate organizational, physical and technical measures to protect personal data.
NPC Circular No. 16-03 also sets requirements for reporting qualifying personal-data breaches.
Where the mandatory notification conditions are met, personal information controllers generally must notify the NPC and affected data subjects within 72 hours from knowledge of, or reasonable belief that, a notifiable breach has occurred, subject to the applicable rules.
The NPC has also stressed that outsourcing information technology operations does not remove an agency’s responsibility for personal information under its control or custody.
In other words, government institutions remain accountable for protecting personal data even when external contractors or service providers handle parts of their systems.
The commission expects agencies to do more than submit notifications. They must address security weaknesses, mitigate potential harm and inform affected individuals when required.
What Filipinos Should Do While Investigations Continue
Although authorities have not released a consolidated figure for affected individuals, the public should remain alert to possible scams that exploit news of government data breaches.
Cybercriminals may use personal information to make fraudulent messages appear legitimate.
For example, a scammer might pretend to represent a government agency, claim that a taxpayer account needs verification or send a suspicious link supposedly intended to help someone check whether their records were exposed.
Filipinos should take these precautions:
1. Be cautious of unexpected messages. Do not automatically trust texts, emails or social media messages claiming to provide information about a government data breach.
2. Avoid unfamiliar links and attachments. Access government websites by entering their official addresses or using verified channels.
3. Protect account credentials. Use strong, unique passwords and enable multi-factor authentication where available.
4. Monitor important accounts. Watch for unusual login alerts, unexpected password-reset requests and suspicious transactions.
5. Never disclose passwords or PINs. Do not provide confidential credentials to people who contact you unexpectedly.
6. Verify requests directly with government offices. Use contact details published on official agency websites rather than numbers or links included in suspicious messages.
The NPC has specifically warned that phishing, identity theft and social-engineering attempts may exploit public concern surrounding the reported incidents.
Government Cybersecurity Faces Growing Pressure
The reported incidents highlight the challenges facing government institutions as more public services move online.
Digital platforms help citizens access services, submit applications, manage tax obligations and conduct business transactions without always visiting government offices.
But these systems also store information that can become valuable to criminals if security controls fail.
The issue is not limited to one agency or one type of information system.
In September, the Land Transportation Franchising and Regulatory Board confirmed a security breach involving its Electronic Support System and temporarily took the platform offline while authorities investigated.
That incident demonstrated how a cybersecurity problem can affect both information security and the delivery of public services.
The wider threat also extends beyond government offices. Cyberattacks against businesses, professional organizations and online platforms show why data protection has become an increasingly important operational responsibility.
For more related coverage, read WWC ONE MEDIA’s reports on the LTFRB incident, cybersecurity threats targeting law firms and other developments involving digital privacy and online security.
What Happens Next in the Investigation?
The next major development will depend on the findings of the ongoing technical and regulatory assessments.
The CICC is working to identify the people behind the alleged attacks and determine whether the information posted online represents new breaches or previously exposed datasets.
The NPC, meanwhile, is reviewing the notifications submitted by the 10 government agencies and institutions.
The BIR is continuing its forensic investigation with the CICC and DICT-NCERT, while government agencies are expected to address vulnerabilities and strengthen their security measures.
For now, authorities have not established that all the alleged incidents are connected, nor have they confirmed that every agency named in online hacking claims suffered a successful breach.
The biggest question is no longer just how many government agencies hackers have named. It is how much personal information, if any, was actually taken—and whether authorities can identify those responsible before the same data is used to target ordinary Filipinos.
