Philippine privacy regulator receives data breach notices from at least 10 agencies

The Philippines' National Privacy Commission (NPC) has confirmed that on Tuesday, November 10, it received data breach notifications from at least 10 public agencies, according to The Philippine Star. They include the Department of Information and Communications Technology (DICT), the tax agency (BIR), the Securities and Exchange Commission, the Coast Guard and the volcanology and seismology institute.

According to the newspaper, NPC spokesman Jose Belarmino II explained that each notification is being evaluated by its compliance division and that outsourcing IT services does not exempt agencies from their responsibility. The NPC urged the public to watch out for phishing attempts and scams exploiting these breaches.

The BIR said in an advisory on Tuesday, quoted by the same newspaper, that it is responding to incidents reported on November 6 and 7, that certain taxpayer profile data may have been exposed and that, according to its initial findings, no data was modified or lost and filing and payment records were not affected. The NPC notice responds to a report by the monitoring group Deep Web Konek which, according to The Philippine Star, points to leaks at up to 23 institutions between November 5 and 7.

Developing story: the original statements from the NPC and the BIR still need to be read; it is not known how many people are affected or whether the breaches have a common origin. The notifications date from November 10, before this slot's search window.