MANILA, Philippines — The Land Transportation Franchising and Regulatory Board (LTFRB) has confirmed a security breach involving its LTFRB Electronic Support System (LESS) and temporarily taken the platform offline while government cybersecurity authorities investigate what happened.
The agency said the incident affected the LESS data environment, but the specific information involved and the full extent of the breach have not yet been determined. As a precaution, all services and transactions handled through LESS have been suspended until further notice.
The development places a major government transport platform under scrutiny because LESS supports electronic transactions and records involving the LTFRB.
LTFRB: Investigation Still Underway
Acting LTFRB Chairman Greg Pua Jr. said the agency is working with information technology specialists from the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC) to assess the incident.
The National Privacy Commission (NPC) is also involved in the response, according to the LTFRB. Officials are conducting technical validation to determine what data may have been affected and whether unauthorized access resulted in the exposure or acquisition of information.
For now, LTFRB personnel and concerned offices have been instructed not to access or process transactions through LESS until the agency announces that the system has been safely restored.
What Data Was Exposed? That Remains the Key Question
The confirmation of a breach comes amid earlier reports of an alleged LTFRB data leak.
A cybersecurity report cited by Newsbytes.PH said a threat actor using the name “core849” claimed to have obtained approximately 7.7 gigabytes of LTFRB data, allegedly including personnel information, vehicle registration data, and franchise and operator records. The claim reportedly involved as many as 16 million records.
However, those figures and the authenticity of the alleged leaked data have not been independently verified.
That distinction is important: the LTFRB has now confirmed a security breach involving its LESS environment, but it has not confirmed that 16 million records were compromised, nor has it publicly established that the breach was connected to the “core849” claim.
Transport Coalition Demands Technical Answers
The issue had already prompted Coalition 169, a transport-sector group, to call for a formal technical report from the Department of Transportation (DOTr) and LTFRB.
The coalition raised questions about two reported cybersecurity incidents, including the alleged 16-million-record exposure. It said an authoritative technical assessment is needed to determine whether government systems or personal information were actually compromised.
The group also pointed to an earlier alleged incident in August involving a group calling itself “Quantum Security Group.” Whether that incident is connected to the latest confirmed breach remains unclear.
The Timing Comes as Government Cybersecurity Rules Tighten
The LTFRB incident comes just as the DICT has introduced stricter cybersecurity requirements for government agencies.
According to the Philippine News Agency, DICT Department Circular No. HRA-008, series of 2026, requires covered government agencies to undergo vulnerability assessment and penetration testing (VAPT) at least once a year, as well as when major system changes or cybersecurity incidents occur.
The policy also establishes remediation timelines based on the severity of vulnerabilities, with critical vulnerabilities required to be addressed within five business days under the circular.
The government has therefore been placing increased emphasis on identifying weaknesses before they result in data breaches or interruptions to public services.
What Happens to LTFRB Transactions?
For now, the immediate impact is operational.
Because LESS has been placed offline, transactions and services dependent on the platform remain suspended until further notice. The LTFRB has not announced a definite timetable for restoring the system.
The agency said its technical personnel are working with other government cybersecurity specialists to determine the appropriate security measures before the system is restored.
The LTFRB has also apologized for the disruption and said additional information will be released once investigators have verified the facts.
Why the Investigation Matters
The incident involves more than an ordinary website outage.
A government transport system can contain information connected to drivers, vehicle records, public utility vehicle operators, franchises and agency personnel. If investigators determine that personal information was actually accessed or extracted, the incident could raise additional questions about data-protection obligations and whether affected individuals need to be notified.
For now, however, those questions remain dependent on the technical investigation.
What is confirmed: LTFRB’s LESS environment suffered a security breach and was taken offline.
What is not yet confirmed: the exact data compromised, the number of records affected, how the attackers gained access, whether the reported 7.7-gigabyte dataset is genuine, and whether the alleged 16 million records were actually exposed.
The next major development will likely come from the technical assessment being conducted by the LTFRB, DICT, CICC and NPC—and that report could determine just how serious the incident ultimately was.
