Philippines SEC confirms data breach affecting user information

The Securities and Exchange Commission (SEC) of the Philippines has confirmed a data security incident involving its online platforms. According to the regulator, the breach may have exposed sensitive personal information, including full names, usernames, email addresses, mobile numbers, dates of birth, physical addresses, and Tax Identification Numbers.

An internal assessment by the SEC indicated that passwords stored in its databases were not leaked, corporate filings remained unaffected, and system data was neither altered nor destroyed. The commission suggested the leak might have originated from malware infections or unauthorized third-party access targeting individual devices used to log into the portals, rather than a direct breach of the agency’s own servers.

The incident follows reports from a cybersecurity advocacy group, Deep Web Konek, which noted a forum entry offering 487,000 lines of alleged SEC information for sale. The SEC has formally reported the matter to the National Privacy Commission and is conducting investigations to verify the origin, scope, and legitimacy of the leaked dataset. In response, the agency has reinforced access controls and updated authentication credentials.