Old KYC Systems Still Hold Customer IDs: Lessons From a Fintech Incident
Written 31 October 2026 (PHT). This post is based on the notice Moneybees sent to affected customers. We will update it if the company shares more details.
What the notice says
According to the notice Moneybees sent to affected customers:
- On 24 October 2026, an unknown outside party used a weakness in one of Moneybees' legacy systems to retrieve KYC records.
- The records included document type, ID type and ID number, among other KYC fields.
- Name, email, mobile number, address and password were not involved.
What is publicly known about Moneybees: Moneybees Forex Corporation runs over-the-counter crypto, forex and remittance services, and its KYC asks customers for government IDs and, for higher limits, extra documents (Moneybees terms). It moved its KYC to a digital process across outlets in early 2023 (BitPinas). Its privacy policy commits to notifying the NPC and affected people within 72 hours of a notifiable breach (Moneybees privacy policy).
What is not known: which system was affected, how the weakness worked, how many records were taken and who was behind it.
Why legacy KYC systems are a common blind spot
Moneybees has not shared the technical details. The patterns below are common ways old identity data gets exposed. They are not a description of what happened at Moneybees.
- Left behind after a migration. When KYC moves to a new platform, the old database, upload folder or admin tool often keeps running "just in case", with fewer updates and less monitoring.
- Weak access checks on old APIs. An endpoint checks that someone is logged in but not that the record belongs to them, so changing a number in a request returns another customer's file.
- Misconfigured storage. ID images and exports sit in cloud storage or file shares with broader access than intended.
- Unpatched software. Older apps stop receiving fixes, and known vulnerabilities stay open.
What fintechs can do
Find and retire
- Keep an inventory of every system, bucket and API that has ever held KYC data, including ones from before a migration.
- Delete or archive what you no longer need, following your retention schedule and the Data Privacy Act's proportionality principle. Data that no longer exists can't leak.
Restrict
- Check access on every record, not just at login.
- Put old admin tools behind a VPN or zero-trust access, never on the open internet.
- Review storage permissions and turn off public access by default.
Protect the data itself
- Encrypt ID images and numbers at rest, and mask or tokenise ID numbers where staff don't need the full value.
Watch and respond
- Log and alert on unusual bulk reads or exports from KYC stores.
- Include legacy systems in regular vulnerability scans.
- Keep a tested breach response plan that meets the NPC's 72-hour notification window.
If you received a breach notice: what to do
Practical steps for affected customers
- Keep the notice and note the date you received it.
- Treat "re-verify your KYC" or "claim compensation" messages as suspicious. Contact the company only through its official app, website or hotline.
- Watch for accounts, loans or SIM registrations you didn't open. You can request your credit report from the Credit Information Corporation.
- Turn on stronger sign-in protection on your e-wallets and bank apps, and never share one-time codes.
- Ask the company what data of yours was involved and what it is doing about it.
- If you don't get a clear answer, you can file a complaint with the National Privacy Commission.
Next step
Not sure where your old customer data lives? Usap Tayo: book a short call and ARA Industries can help you map and secure legacy systems that still hold personal data.
Sources
- Moneybees, notice to affected customers, October 2026 (sent directly to customers; not posted publicly).
- Moneybees, Terms and Conditions, updated 27 August 2026. moneybees.ph
- Moneybees, Privacy Policy, updated 27 August 2026. moneybees.ph
- BitPinas, "Moneybees Mid-Year 2023: Highlights and Outlook". bitpinas.com
Sources 2–4 checked 31 October 2026 (PHT).
Frequently asked questions
How was the Moneybees incident disclosed?
Moneybees disclosed it directly to affected customers in a notice. As of 31 October 2026 we had not seen a separate press statement, and we will update this post if more details are published.
Were passwords or contact details taken?
The notice says name, email, mobile number, address and password were not involved.
Do I need to change my password?
The notice says passwords were not involved, but changing it and turning on stronger sign-in protection is a sensible, low-effort step.
Why does an ID number matter if my password is safe?
Unlike a password, an ID number can't be changed. It can be combined with other data to try opening accounts, loans or SIM registrations in your name.
