Philippine Cyber Incidents: Tracker, Trends and What Businesses Should Do

Last updated: 9 November 2026 · Figures from incident map data generated 7 November 2026, 9:27 AM PHT

This page is the ARA Industries running summary of cyber incidents reported in the Philippines. Instead of writing a new article for every incident, we update this page as entries are added to our Philippine Cyber Incident Map, and record each change in the update log at the bottom.

In brief: most new entries are claims made on leak sites and forums, not confirmed breaches, and government agencies appear far more often than any other group. That says as much about what gets made public as about who is targeted. For a business, the useful response is the same either way: check a short list of basics, and know what you would do on the day it happens to you.

Open the live Philippine Cyber Incident Map →

Where can I see the latest incidents?

The newest entries, with filters by year, sector and status, are on our live incident map. Each entry is labelled confirmed, alleged or refuted; see how we track and label incidents. This page carries our incident briefings and the patterns behind the entries.

Incident briefings

Significant incidents get a full briefing on this page instead of a separate article: what happened, a timeline, what is confirmed, claimed and unknown, and what businesses should do, with sources. The newest briefing comes first. Smaller or repeat claims stay on the incident map only.

BIR data leak probe (November 2026)

Briefing published 9 November 2026 (PHT). Sources checked 8 November 2026 (PHT). Map entry status: alleged, under investigation.

The Bureau of Internal Revenue is investigating reports of an alleged data leak. That is a reason to check how your business handles tax data. It is not a basis for telling employees that their tax records have been exposed.

In brief: BIR has acknowledged the allegations and is working with government technical and law-enforcement teams. The sources reviewed do not establish what data, if any, was taken. ARA Industries recommends verifying unexpected tax messages independently, securing accounts used for tax work, and tightening document exchange while waiting for verified updates.

What is confirmed, claimed and still unknown?

Confirmed: BIR’s official advisory says it is urgently looking into alleged leak reports and will provide further updates as verified details become available. [1]

GMA News reported on 7 November that the bureau is coordinating with DICT, the National Computer Emergency Response Team (NCERT), the Cybercrime Investigation and Coordinating Center (CICC), and the PNP Anti-Cybercrime Group to investigate and strengthen security measures. GMA says BIR did not disclose the scope or information types involved. [2]

Claimed, not independently verified: Radar reported on 6 November, citing monitoring group Deep Web Konek, that a forum user calling themselves “sinigangmixwithgabi” shared files purportedly associated with BIR. A Deep Web Konek report describes an alleged forum post claiming approximately “340K lines.” That is not an official count, proof of genuine BIR data, or a count of unique taxpayers. We have not downloaded or inspected any purported leaked records. [3][4]

Unknown: authenticity, origin, age and completeness of the purported files; whether taxpayer information was exposed; affected people or record totals; data types; entry method; and responsibility. No verified BIR-specific exposure of TINs, addresses, financial records or credentials was established by the reviewed sources.

Timeline

• 8 September 2026 — separate earlier incident: according to GMA’s later report, BIR described a brief website defacement and said its initial assessment found taxpayer information and core systems unaffected. No connection to the November allegations has been established. [2]
• 5 November — allegations emerge: the NPC says reports concerning several government agencies circulated on this date. Deep Web Konek dates the purported BIR forum claim to 5 November; this remains a monitoring report, not forensic confirmation. [4][5]
• 6 November — NPC statement: the NPC said it would verify reports concerning several agencies and had received no related personal-data breach notifications as of that date. Its statement does not name BIR. [5]
• 7 November — BIR investigation reported: GMA reported BIR’s advisory acknowledging the alleged leak reports and described the participating agencies and the absence of disclosed scope. GMA’s “Friday, November 7” wording has a weekday error (7 November 2026 was a Saturday). This timeline uses GMA’s publication date for this coverage, not an inferred incident or advisory issuance date. [2]
• 8 November — further coverage: The Philippine Star reported the NPC’s verification work and named BIR among reportedly affected agencies. This is not a finding that BIR taxpayer records were compromised. [6]

The NPC’s statement explicitly warns that alleged leak reports alone do not establish a personal data breach or a Data Privacy Act violation. Lack of a notification on 6 November does not prove no breach happened, nor does it tell us whether a notification was filed later. [5]

Why it matters for businesses

Tax administration involves identifying and financial information. If exposed in any incident, TINs, addresses and financial details could make impersonation messages more convincing. A real identifier in a message is not proof that its sender is BIR.

Possible misuse includes tax-themed phishing, requests for identity documents, fake invoice or payment changes, and identity fraud. These are risk scenarios—not reported outcomes of this alleged incident. Nothing in the reviewed sources establishes that those categories of data were leaked here or that a related fraud campaign is underway.

What should your team check now?

These are ARA Industries recommendations, not new BIR instructions.

1. Verify tax messages independently. Do not use an unexpected message’s link, callback number or attachment to establish legitimacy. Open the BIR website separately and use its official contact page or your established revenue district office contact. Check any payment or bank-detail change through a second, known channel.
2. Review eFPS, eBIRForms and ORUS workflows. Use verified official entry points and current official software guidance. Review who can submit filings, reset access or receive account notices. Use unique passwords wherever accounts exist; do not share credentials with staff or accountants. Enable MFA where the specific service supports it. Do not assume every BIR service offers MFA or that eBIRForms has the same account model as ORUS.
3. Protect the connected email accounts. Enforce MFA on business email and password-manager accounts where supported. Review recovery details, active sessions and unexpected mailbox forwarding rules. Investigate suspicious sign-ins and revoke compromised sessions; change any exposed or reused password.
4. Brief finance, payroll and reception staff. Use a short example: “Someone quoting a TIN and asking for urgent documents still needs independent verification.” Flag unexpected audit notices, refund offers and requests to move conversations to personal messaging. Keep ordinary filing deadlines in view; do not invent a new emergency deadline.
5. Map document exchange. List what goes to BIR and to your accountant, by whom and through which channel. Minimize copies of employee TINs, IDs, payroll files and tax returns. Prefer approved access-controlled sharing with expiry and an agreed retention period; verify recipients before granting access. Avoid public links and credentials inside the same message as documents.
6. Check your own privacy duties. Involve your data protection officer when employee or client tax records may be involved in an incident. Restrict access, retain only what is needed, and document processing and incident decisions. Your duties under the Data Privacy Act do not disappear when an accountant handles records for you. [7]
7. Monitor without spreading records. Watch official BIR and NPC updates, account alerts and unusual payment instructions. Preserve suspicious messages and relevant logs through your internal response process. Do not download alleged dumps, circulate personal-data screenshots, or submit TINs to unofficial “breach check” forms. The NPC has separately cautioned against unauthorized access, downloading or sharing of leaked personal data. [8]

When does the 72-hour notification rule apply?

The NPC’s 6 November statement says personal information controllers must notify the Commission and affected data subjects within 72 hours upon knowledge of, or reasonable belief that, a personal data breach requiring mandatory notification has occurred. Under the Circular, notification is mandatory only when sensitive personal information or information that could enable identity fraud is reasonably believed to have been acquired by an unauthorized person, and that acquisition is likely to give rise to a real risk of serious harm. A full report goes to the NPC within five days unless the NPC grants more time. Not every security event is automatically notifiable. Assess the criteria under NPC Circular No. 16-03 promptly with your data protection officer or appropriate adviser; do not wait for a final forensic report before assessing the trigger. [5][9]

This news alone does not mean your company must file a breach notification. If you discover a separate exposure of records you hold, assess that incident on its own facts.

Sources for this briefing

1. BIR official advisory (issuance date not independently verified): Official Facebook post. Caption directly reviewed; coordination detail also reported by GMA.
2. GMA News, 7 November 2026, 12:27 PM PHT: BIR ‘data leak’ under government probe.
3. Radar, 6 November 2026: Government data breach claims pile up. Attribution of claims, not confirmation.
4. Deep Web Konek, publication date not displayed in retrieved report; describes a 5 November 2026 forum claim: Alleged BIR leak claims 340,000 records. Unverified monitoring claim; no dataset accessed.
5. NPC, 6 November 2026, 12:25 PM PHT: Statement on reported data leaks involving government agencies. Does not name BIR.
6. The Philippine Star, 8 November 2026: NPC probing government data leaks.
7. Republic Act No. 10173, 15 August 2012: Data Privacy Act text hosted by NPC, particularly sections 20–21 on security and accountability.
8. NPC, 8 April 2024: Press statement on handling allegedly leaked data. A general handling precaution from an earlier, separate case; not evidence about BIR.
9. NPC Circular No. 16-03, 15 December 2016: Personal Data Breach Management.

Back to contents

Which sectors are hit most?

Figures from the ARA Industries Philippine Cyber Incident Map data file, generated 7 November 2026, 9:27 AM PHT; latest entry dated 6 November 2026. Counts cover public reports and claims, including refuted entries; they are not a count of verified breaches.

• 83 entries on the map in total (50 from 2026, 22 from 2025, 11 from 2024).
• 50 entries dated 2026: 8 confirmed, 41 alleged and 1 refuted.
• Across all years: 25 confirmed, 55 alleged and 3 refuted.
• Most-listed group in 2026: government agencies and LGUs, with 26 of 50 entries (5 confirmed).

Organizations listed in 2026, by sector

Group	Entries	Share
Government agencies and LGUs	26	52%
Other businesses and organizations	6	12%
Healthcare	5	10%
Education	4	8%
Transport and maritime	3	6%
Financial services and crypto	3	6%
Telecom and technology	3	6%

What happened in 2026, by type

Group	Entries	Share
Data breach, leak or access claim	31	62%
Ransomware	11	22%
Website defacement	4	8%
Disruption, supply chain and other	2	4%
Intrusion or espionage	2	4%

Entries by month in 2026

Month	Entries
January	1
March	2
May	1
July	2
August	5
September	15
October	12
November	12

The map started close tracking in mid-2026, so earlier months are likely under-counted. Sector and type groups are ARA Industries groupings of the map’s own sector and incident-type fields.

Three patterns hold across recent updates:

• Data-exposure claims dominate the tracker. Most entries are breach or leak claims, not systems being shut down. The risk for businesses is customer and employee data turning up somewhere it should not be.
• Government entries dominate this tracker. ARA Industries’ analysis is that differences in public visibility may contribute; the tracker does not establish comparative disclosure rates or sector-wide attack rates.
• Claims arrive in bursts. Several agencies are often named in the same week by the same groups. Bursts get attention, but many claims stay unconfirmed, so wait for the affected organization or the NPC before drawing conclusions.

Patterns: who gets targeted and why

This section looks only at incidents logged on our incident map. It does not cover incidents, groups or arrests outside the tracker.

What the data shows

Computed from the same map data (generated 7 November 2026, 9:27 AM PHT), 2026 entries only unless stated.

• Public-sector-related vs other entries: 29 of 50 entries involve government agencies, LGUs, public hospitals or state schools; 21 involve other organizations. This is ARA Industries’ classification of the map entries, not a measure of sector-wide risk.
• Ransomware-related entries: 9 of 11 concern private organizations; most remain alleged, and 1 of the 2 government entries was refuted.
• Leak claims are mostly unconfirmed: 28 of 31 data breach, leak or access entries are still labelled alleged.
• A name is attached to 36 of 50 entries (a self-declared group, alias or ransomware brand). Name spellings seen more than once: sinigangmixwithgabi (3), core849 (3), Qilin (3), 4HMDOS4 (3), Happy Go Lucky PH (2), DeathNoteHackers (2), SafePay (2). These are map-name spellings, not verified actor totals, and are self-claimed unless an authority says otherwise.
• Busiest single days: 6 November 2026 (7 entries), 5 November 2026 (5 entries), 7 September 2026 (3 entries).
• Organizations on the map more than once (all years): Philippine Air Force (2), Department of Migrant Workers (2).

Who claims these incidents?

Most names on the map come from the attackers themselves, through forum posts, leak sites or social media. We keep two groups separate:

• Confirmed by an authority or the victim. Some incidents were confirmed, such as the LTFRB records breach, the DMW website intrusion and the DICT test-site defacement. Being confirmed does not mean the attacker was confirmed. These examples confirm incidents, not the identities of the people responsible. In the sources we reviewed as of 8 November 2026, we found no arrest or law-enforcement-confirmed attribution tied to these entries.
• Self-claimed or unverified. Aliases such as core849, sinigangmixwithgabi, DeathNoteHackers, Happy Go Lucky PH and 4HMDOS4 appear in forum and social posts that monitoring groups relayed. Ransomware brands such as Qilin and SafePay appear on their own leak sites. For the incidents reported on 5 November, CICC Executive Director Renato Paraiso said the reports had not yet been referred to the CICC or the DICT Cybersecurity Bureau. The NPC said reports alone do not establish that a personal data breach occurred.

We do not try to identify the people behind these names, and an alias does not tell you where someone is based. If an authority confirms an attribution or makes an arrest tied to a tracker entry, we will add it here with the source.

Why they do it: our analysis

This is ARA Industries analysis, not established fact. It uses common threat-intelligence categories and the evidence attached to each entry.

• Protest and hacktivism. Some claims come with political messages. The OVP scheduling-system leak claim carried statements criticizing government spending and campaign tags linked to Million Mask March 2026. The Philippine Air Force HRMIS entry on our map carries a #MMM2026 tag. A reported law-firm website defacement in August carried messaging about the Vice President; the map labels this incident alleged.
• Politically timed bursts. The two busiest days on the map, 5 and 6 November 2026, line up with the Million Mask March tagging; Newsbytes reported BetterGov.PH’s note that the reports coincided with the 5 November march, with no connection established, and come just before the ASEAN Summit the Philippines is hosting this month, which press coverage of the same incidents raised. The timing is a pattern, not proof of motive.
• Notoriety on forums. Large, round claims such as "340K lines" or "16M records", posted under a recurring alias, may be intended to build a reputation on forums; the tracker does not establish the motive behind any post. Repeat aliases on the map fit that pattern.
• Money: extortion and resale. Ransomware brands such as Qilin, SafePay and Rhysida list victims to pressure them to pay, and most ransomware entries on the map are private hospitals, labs, lenders and contractors. Some forum entries, such as the PeekUp database sale claim, offer data for sale.
• Exposure of public-facing systems. Defacements and access claims often hit web portals, test sites and HR systems, such as the DICT staging site. The cited reports do not establish how access was obtained or whether core systems were reachable.

What this means for businesses

ARA Industries’ analysis: these entries illustrate why businesses should protect employee records, customer IDs and patient data, and review internet-facing logins and third-party platforms. Some posts claim access to HR systems, payroll files and customer databases, but those claims do not establish an attacker’s motive or the extent of access. The checklist below addresses those exposures without assuming that any particular business will be targeted.

What should Philippine businesses do?

None of this calls for panic. It calls for a few checks you can finish in a week, then repeat every quarter.

1. Turn on phishing-resistant multi-factor login for email, accounting, banking, payroll and cloud admin accounts. Prefer an authenticator app or security key to SMS codes.
2. Keep one backup offline or immutable, and test a restore. Ransomware is the second-largest group on the map this year.
3. Patch or hide internet-facing systems: firewalls, VPNs, remote desktop and web admin pages. Do not leave management interfaces open to the internet.
4. Know where personal data lives. List the systems that hold customer, employee and student records, who can reach them, and which vendors hold copies.
5. Watch admin accounts. Remove old accounts, give admin rights only to people who need them, and alert on new admin logins.
6. Write a one-page incident plan: who decides, who calls your data protection officer, how you would reach the NPC within 72 hours if required, and who talks to customers.
7. Check your vendors. Ask your key providers how they protect your data and how fast they will tell you about an incident. Some of the write-ups below started at a vendor or reseller.
8. Brief your team on verification. After a big headline, scam messages follow. Tell staff to confirm requests through a known number or official site, not the message itself.

ARA Industries is a registered WithSecure partner and can help review endpoint protection and monitoring needs, and arrange penetration testing and digital forensics and incident response. Start with the free checklist below, or Usap tayo.

Our incident write-ups

When an incident teaches something specific, we write it up in full. These are linked from here as they go live:

• Cybersecurity Awareness Month wrap-up: the incidents that hit Filipinos hardest in 2026
• The Frontline Education breach: what schools that rely on EdTech vendors should check
• Old KYC systems still hold customer IDs: lessons from a fintech incident
• The Binance incident: how one admin laptop can open the door
• PHP2Shell: attackers target exposed firewall management pages
• Callback phishing: the scam email with no links, only a phone number
• How to spot a GCash or Maya phishing text

Update log

• 9 November 2026: Incident briefings area added; BIR data leak probe moved in as the first briefing. Labelling method moved to the incident map. Public-sector and named-claimant counts corrected (29 and 36 of 50 entries for 2026).
• 8 November 2026: Page created from incident map data generated 7 November 2026, 9:27 AM PHT (83 entries). BIR data leak probe added as alleged, under investigation. Patterns section added.

Next step: get the free Cyber Health Check

Use the checklist to check your own basics, then compare it with what is showing up on the incident map.