We Built a Cyber Incident Map for Our Sales Team. Now It’s Public.

When someone asks “Is the Philippines really being hit that often?”, a vague answer doesn’t help. So the ARA Industries team started keeping a log. Every time a Philippine organization showed up in a public breach report, a ransomware leak site, a defacement or a government advisory, we wrote it down, linked the source and pinned it on a map.

The log was built for our sales team. It gave them real, sourced local cases to point to, so they didn’t have to rely on global statistics that feel far away. Over time we realised the same view could help everyone: IT teams, school administrators, LGU staff, business owners, journalists and students who want to see how the Philippine cybersecurity landscape is actually going.

So we’ve made it public: incidents.ara.ph.

What the map shows

The Philippine Cyber Incident Map shows where Philippine organizations hit by publicly reported incidents are headquartered from 2024 to the present. As of this writing it holds 60 incidents, dated from February 2024 to October 2026.

Each entry records:

• the organization and its sector
• the incident type (data breach or leak, ransomware, website defacement, intrusion or espionage, and others)
• the threat group or claimant, where one was named
• the location, pinned at the affected organization’s head office (verified from official sources)
• its status: confirmed, alleged or refuted
• a link to the original public source

The summary cards at the top show totals by year, ransomware count and status at a glance. The panel beside the map breaks incidents down by type.

How to use the filters

You can narrow the map with these filters:

• Label: show only confirmed, alleged or refuted entries.
• Incident type: for example, only ransomware or only defacements.
• Region: for example, NCR or a specific region outside Metro Manila.
• Threat group: see everything attributed to one named group.
• Sector: government, education, healthcare and more.
• From / To: limit the view to a date range.
• Search: find an organization or keyword.

Click any pin to see the details and the source link. Reset clears everything.

Where the data comes from

Everything on the map comes from public reporting: news outlets such as Philstar, Rappler, GMA News, PNA and SunStar, specialist trackers such as Deep Web Konek, Newsbytes.PH and Tech Watch PH, researcher disclosures, and official statements.

We take labelling seriously:

• Confirmed means the affected organization or the authorities acknowledged the incident.
• Alleged means an attacker or researcher claimed it, and it has not been independently verified. A ransomware gang posting a name on a leak site is a claim, not proof.
• Refuted means the named organization denied the claim with evidence. We keep those entries visible, because a false claim is part of the story too.

Being on the map is not a finding of fault. Many of these organizations were victims of criminals, and several handled their response well.

What the data reveals

Here is what the current 60 entries show:

• Government is the most affected sector. 31 of the 60 incidents (52%) involve a government body, counting national agencies, LGUs, defense, maritime and law enforcement together.
• Data breaches and leaks dominate. 30 incidents (half) are data breaches or leaks. Ransomware accounts for 11, and website defacement (including defacement with intrusion) for 10.
• Education is the second most targeted sector, with 9 incidents. Schools and universities hold large amounts of personal data, often with small IT teams.
• Metro Manila is the hotspot. 44 of the 55 incidents with a verified head office are pinned in the NCR, 20 of them in Quezon City alone. That reflects where head offices sit and where reporting is strongest, not where attackers are.
• Many claims are still unverified. 32 entries are alleged, 26 confirmed and 2 refuted. More than half of what circulates publicly has not been acknowledged by the organization involved.
• Attribution is usually missing. 32 entries have no attributed threat actor. Where a group is named, the ransomware group Qilin appears most often, with 5 entries.
• Reported incidents are rising. We logged 11 incidents in 2024, 22 in 2025 and 27 in 2026 so far. That may reflect more attacks, better reporting or our own coverage improving, and probably some of each.

None of this needs a “super-hacker” story. Most of these incidents fit the familiar pattern of automated scanning, known exploits, weak or reused credentials and exposed data, and so does the defense: patching, MFA, monitoring and backups you have actually tested.

Limitations

This is a curated public log, not a complete census. Please keep these in mind:

• Underreporting. Most incidents in the Philippines are never made public. The map shows what was reported, not everything that happened.
• Coverage bias. Incidents that get media attention are more likely to be included. Government and large organizations are more visible than SMEs.
• Head office, not attack site. Pins mark the affected organization’s head office, not the attack origin or attacker location. Five entries cover many organizations or an unnamed one, so they stay at the centre of the country and are marked approximate.
• Alleged means alleged. Treat unverified claims with caution until the organization or authorities confirm them.
• Point in time. The figures in this article reflect the data at publication. The map will keep changing as we add and update entries.

If you see an error or have a public source we missed, use the corrections link on the map.

Talk to us

If you want to understand what these incidents mean for your organization, or want a walkthrough of the map for your team, we’re happy to talk. Book a short session here: Usap Tayo with ARA Industries.

Explore the map: incidents.ara.ph

---

Sources: All figures are counted from the ARA Industries Philippine Cyber Incident Map dataset (60 entries, 13 Feb 2024 to 14 Oct 2026, as of 16 Oct 2026). Each entry links to its original public report, including Philstar, Rappler, GMA News, PNA, SunStar, Deep Web Konek, Newsbytes.PH, Tech Watch PH, SchoolBreach.org and DeXpose.