MANILA — A unit of the Department of Information and Communications Technology (DICT) suffered a data breach on Tuesday morning, the agency said. 

But the DICT, which is tasked to improve cybersecurity in the country, also downplayed the incident, saying it was a minor breach.

DICT Spokesperson Assistant Secretary Renato Aboy Paraiso said the system of the DICT Disaster Risk Reduction Management division was breached by a hacker. The website of the said division was defaced with political messages and a call for DICT to seriously improve cybersecurity efforts in the country.

Paraiso asserted that the said system is not connected to the central system of the DICT and is in fact intentionally designed not to be secured. He said the unit, being an emergency and response division, has fewer firewalls so they can respond immediately.

“This system is outside the system of central office. It was designed to be porous so the flow of information during emergencies and disasters would easily reach DICT for appropriate actions and responses. So di siya ganun karaming firewall,” he said.

He added that the compromised data consists of only less than 5 megabytes and includes information of less than ten employees of the division as well as data on emergency assets and vehicles. He already notified the National Privacy Commission since it still affected some personal information of employees.

“When it comes to yung extent, yung dami ng data, very very minor.”

The threat actor or hacker challenged DICT that it will be back, and Paraiso said they are doing all they can to improve the agency’s cybersecurity. 

He admitted though despite efforts to improve cybersecurity, budget is always a problem.

“There is a lot to be done. We have to face budgetary constraints of government pagdating sa pagbili ng ating mga hardware at infostructure as well yung mga tao na pwede ihire para matulungan tayo icombat cybersecurity threats na ito,” he said.

The breach, reported by cybersecurity advocacy group Deep Web Konek, comes after many other reports of data breaches affecting popular corporations in the Philippines. 

Among those reported to either the DICT, NPC or CICC are possible breaches of Maxicare, Jollibee, and GCash. All the companies mentioned have said they are also investigating these claims.