Philippine agencies investigate data breaches amid biometric theft claims

The National Privacy Commission has confirmed it has received a series of breach notifications from government bodies, but not the one alleged to involve employee biometrics. An online post from a purported hacker claims possession of a dataset including payroll data, attendance logs, account information and biometric identifiers belonging to more than 4,500 Department of Transportation employees, according to the Philippine News Agency. A notice from the NPC published this week does not name the DoT, but it says the regulator has received breach notifications involving personal information from 10 different government bodies, including the Department of Information and Communications Technology (DICT), which manages the eGovPH digital government platform, through which citizens can access their national digital ID.

Cybercrime Investigation and Coordinating Center (CICC) ED Renato Paraiso said in a radio interview that it appears that close to 20 agencies are affected, Philstar Global reports. He also warned, however, that not all of the hacks have been confirmed, and that hackers will sometimes present old data as newly acquired. Paraiso said vulnerabilities associated with the Bureau of Internal Revenue and Securities and Exchange Commission incidents had been contained and remediated.

The Philippines has faced previous allegations involving government identity databases, including a retracted claim that PhilSys was breached in 2024 and claims of an eGovPH data leak in 2025, which DICT denied. The NPC warned the public to be wary of phishing, identity theft, social engineering or other fraud attempts. DICT launched a tender weeks ago worth $7.8 million to strengthen the country’s digital ID infrastructure.