Cybersecurity Awareness Month Wrap-Up: The Incidents That Hit Filipinos Hardest in 2026

October is Cybersecurity Awareness Month, and it's a good time to look back. Since mid-2026, the ARA Industries team has kept a public log of every Philippine cyber incident we can source: the Philippine Cyber Incident Map. Every entry has a link and a label that says whether it's confirmed or only claimed.

So instead of a list of global statistics, here's what actually happened here this year, which incidents hit ordinary Filipinos hardest, and one lesson your team can take from each. At the end there's a five-question self-check and a quick tip for the Undas trip home.

What did 2026 look like in numbers?

From 1 January to 23 October 2026, our map logged 32 publicly reported incidents in the Philippines. Nine are confirmed, meaning the victim, a government agency or the vendor acknowledged them. Twenty-three are claims, usually a listing on a ransomware leak site or a data dump on a hacker forum, that no one had confirmed when we logged them.

Three things stand out:

• Government took most of the hits. Fifteen of the 32 entries involve national agencies or their systems, from the DPWH and the NTC to the DENR and the DICT itself.
• Stolen data is the main story. Sixteen entries are data breach or leak claims, and eight are ransomware. Defacements are the loudest, but they're the smallest group.
• August to October were busy. Twenty-six of the 32 entries were reported from August onward. Part of that is real, and part is that we started tracking closely mid-year, so read the early months as a floor, not a total.

One more honest caveat. A claim is not a fact. In September, DICT reviewed system logs after reports of a ransomware attack on the Philippine Ports Authority and called it a false positive. We've left it out of the count above.

Which incidents hit Filipinos hardest in 2026?

We picked these by who felt them, not by how many gigabytes were claimed. Most are confirmed. The last one is a pattern of claims we think every clinic and hospital should take seriously.

1. MARINA: when seafarers couldn't get their papers

On 13 August, the Maritime Industry Authority's SID/SRB systems were hit by a cyberattack, and regular processing of seafarer identity documents and record books was suspended nationwide. For seafarers with a ship to catch, that's a job on the line.

MARINA kept expedited cases moving with stop-gap paper. From 13 to 29 August it issued 2,492 certifications to seafarers with immediate deployment, extended expiring record books by a year, and started an interim system on 1 September. The Central Office was back to normal processing on 16 September.

The lesson: have a manual fallback for the system your customers queue for. MARINA's certifications kept people deploying. Ask what your version would be if your booking, billing or POS system went dark for two weeks.

2. LTFRB: a breach, and no quick answer to "what was taken?"

In September, the LTFRB confirmed a data breach and took its LTFRB Electronic Support System (LESS) offline, suspending every service that ran through it. A threat actor had claimed 16 million records. The agency said the specific data involved and the full impact were still "subject to technical validation."

The lesson: know what data each system holds before something goes wrong. Under NPC Circular 16-03, a notifiable breach has to be reported within 72 hours. You can't do that well if no one knows what's in the database.

3. DMW: the break-in is often weeks old

Also in September, DICT confirmed unauthorized access to the Department of Migrant Workers website, which was taken offline while teams investigated. The group behind it claimed it had been inside the agency's Active Directory for more than a month and could reach worker, recruitment and ID records. Those claims were not verified.

The lesson: watch your admin accounts. Attackers rarely deface a site on day one. They log in, look around and wait. Multi-factor authentication on every admin login, plus someone actually reviewing unusual sign-ins, is what shortens that month.

4. Ledger wallets: the threat was inside the box

In October, Ledger found an unauthorized hardware implant in a wallet sold through CryptoBilis, a reseller serving Southeast Asia. The implant read the 24-word recovery phrase off the screen during setup and sent it out over a mobile connection. A blockchain investigator put losses across the region at more than US$86 million; Ledger said it had not confirmed the total. Ledger asked resellers across Southeast Asia, including the Philippines, to pull its devices from shelves while it investigated.

The lesson: buy security hardware only from authorized channels, and never use a recovery phrase you didn't generate yourself. The same goes for company laptops, routers and security keys. We wrote more about this in our cold-wallet phishing guide.

5. Hospitals and labs: patient data is on the menu

Between September and October, four Philippine healthcare providers, including hospitals and a diagnostics lab, were listed on ransomware leak sites or hacker forums. None of these claims had been confirmed when we logged them, and you can see each entry, with its source, on the incident map. Still, the pattern is clear. Ransomware groups think patient records and hospital operations are worth attacking.

The lesson: keep at least one backup that ransomware can't reach, restore from it on purpose, and put endpoint protection with detection and response on every PC, including the one at the nurses' station. Our ransomware snapshot covers the steps.

What other incidents should you know about?

A few more entries from this year matter to specific readers:

• Recruitment and manpower agencies. In October, a DMW-licensed agency was listed on a ransomware leak site with a claim of more than 150,000 résumés. It's unconfirmed, but agencies hold exactly that kind of data. Here's how an agency can protect it this month.
• Schools. A May claim against a DepEd training platform involved close to a million rows of names and emails. If you run a school, start with our guide to automating school admin without leaking student data.
• Telcos. Two major telcos were named in alleged data dumps on forums in late September. Neither had confirmed a breach in the reports we tracked. Whatever the outcome, assume scammers already have your number, and treat any text with a link or a code request as fake until proven otherwise.

Could this happen to your organization?

Here's a five-minute self-check you can run with your team. Each question comes from one of the incidents above.

1. Downtime. If our main system went down tomorrow, could we keep serving customers by hand for two weeks?
2. Data. Do we know exactly what personal data each system holds, so we could report a breach within 72 hours?
3. Admin accounts. Would we notice a stranger using an admin account for a month?
4. Supply chain. Did all our security devices and laptops come from authorized sellers?
5. Backups. Is there a backup that ransomware couldn't reach, and have we actually restored from it?

Every "no" or "not sure" is this month's to-do. If you have two or more, start with backups and multi-factor authentication this week. These line up with the basics in CISA's Secure Our World programme: strong passwords, MFA, updates and spotting phishing.

Heading home for Undas? Watch for these scams

Undas is a busy travel weekend, and scammers know it. For past Undas seasons, the CICC, DOTr and Scam Watch Pilipinas ran Oplan Bantay Lakbay and warned travellers about fake travel agents, too-good-to-be-true deals, ticket fixers, fake customer service, fake e-wallet apps and open Wi-Fi. The list still holds.

Book directly with the bus line, airline, ferry or hotel. Be wary of a cheap seat that has to be paid by e-wallet to a personal account. Use mobile data, not terminal Wi-Fi, for banking. If something goes wrong, call CICC Hotline 1326, which runs 24/7, and report scam texts in the eGov super app.

What should you do next?

Cybersecurity Awareness Month ends this week, but the attackers don't take November off. Pick one "no" from the self-check and fix it before December.

If you'd like a fuller picture, download our free Cyber Health Check: 39 plain-language checks for any small or mid-sized organization. You can also browse every sourced 2026 incident on the Philippine Cyber Incident Map.

ARA Industries provides IT business solutions and cybersecurity for teams without their own security staff, and we're a registered WithSecure partner. If you think something is already wrong, email securenow@ara.ph. Otherwise, usap tayo. No pressure, just a conversation.

Incident details are as publicly reported up to 27 October 2026. Claims are labelled as claims and may change as investigations conclude. This article is general guidance, not legal advice.