Cybersecurity firm reports 68 GB of data from PH gov’t agency found publicly online

Despite file names of the data taken indicating migrant worker organization files, the contents of the backups are not established as Hunt.io did not examine them

AT A GLANCE

• Hunt.io discovered 68 gigabytes of potentially stolen data from a Philippine government agency, which was exposed due to a security oversight by the thief.
• The National Privacy Commission is investigating the incident to determine if there were violations of the Data Privacy Act of 2012.

This is AI-generated. Read the article for full context. Report any errors.

MANILA, Philippines – Cybersecurity firm Hunt.io on Wednesday, October 28, reported that it found what appeared to be 68 gigabytes of data from databases of a Philippine government agency.

In an email to Rappler on Thursday, October 29, the Hunt.io research team summarized the issue as follows: “A thief copied the data, kept a receipt of it, then left that receipt and their tools on a computer anyone online could open. That mistake is how it came to light, not a public dump of the data.”

Hunt.io added it did not have the stolen data, but rather reverse-engineered the tools used and read the logs. The exact nature of the potentially stolen files have yet to be determined because the firm did not examine the data.

The firm noted, however, that the file names discovered match case-management systems operated by agencies like the Philippine Overseas Employment Administration (POEA), and the Department of Migrant Workers’ Balik-Manggagawa Online Processing System, among others.

Hunt.io also previously wrote about a reported hack involving the theft of sensitive files from the Philippines’ nuclear research agency.

The National Privacy Commission (NPC), in a statement on Thursday, said it is “aware of the matter and is conducting an investigation to assess the facts and circumstances of the incident and determine whether any violations of the Data Privacy Act of 2012 have occurred.”

What happened?

Hunt.io operates an automated threat intelligence platform which continuously crawls the internet to catalog web servers, exposed directories, and digital certificates used by malicious actors.

According to the blog post by Hunt.io, the platform detected an open Python web server while it was actively online on September 7. The server gave the operator’s working folder to anyone who asked.

The data was said to be made up of “27 SQL Server backups.”

The report said the file names of the copied SQL backups include POEA_EServices, POEA_HelpDesk, POEAHelpDeskDB, OFW and OfwDB, together with accreditation, repatriation, eContracts, Cashier and LandBank variants of the file names.

Other file names cited include BMonline, BMDB and BMContracts, which match the Balik-Manggagawa Online Processing System; and OWMSDB, which matches the OFW Welfare Monitoring System.

No attributable operator

The blog post added that it does not attribute the activity to a tracked actor.

It said “details that could be mistaken for attribution signals are recorded… without supporting an inference.”

The blog post concluded that the recovered material establishes “a completed theft, a delivery server and tooling rebuilt in place.”

However, what it does not establish “is how the operator entered the agency network, what command ran under SYSTEM, or where the 68.837 GiB was sent.” The operation ended because the working directory was public rather than due to any detection.

In its statement, the NPC said it is “coordinating closely with the Department of Migrant Workers to ensure that any data privacy concerns are appropriately addressed and that the rights and interests of data subjects are safeguarded in accordance with the law.”

The Hunt.io research team meanwhile advised that until the NPC and adjacent agencies confirm the data theft, people should remain cautious. They added, “be wary of scams or messages that reference your OFW or employment records, and trust official notices over anyone else who reaches out.”

Rappler has also reached out to the Department of Migrant Workers and the Philippine National Computer Emergency Response Team for further information.

More technical information is available on Hunt.io’s blog post. – Rappler.com