Over 1.2M records from NBI, PNP, other agencies leaked, firm says

Davinci Maru, ABS-CBN News

<div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="This image shows a Bureau of Internal Revenue card with a tax identification number. Courtesy of VPNMentor" src="https://sa.kapamilya.com/absnews/abscbnnews/media/2023/tvpatrol/04/20/image3.jpg"/><figcaption>This image shows a Bureau of Internal Revenue card with a tax identification number. <em>Courtesy of VPNMentor</em></figcaption></figure></div><p>MANILA (<strong>UPDATE</strong>) — Over 1.2 million records, including sensitive information of applicants and employees of multiple government agencies in the Philippines, have been leaked online, according to a cybersecurity firm.</p><p><a href="https://www.vpnmentor.com/news/report-philippine-police-breach/" target="_blank">VPNMentor</a> said the &quot;massive data breach&quot; includes records from the National Bureau of Investigation, Philippine National Police and Bureau of Internal Revenue.</p><p>The 817.54 gigabytes leaked contained highly sensitive personal information such as passports, birth and marriage certificates, drivers’ licenses, academic transcripts and security clearance documents, the firm said.</p><p>&quot;Individuals whose data is exposed could be potential victims of identity theft, phishing attacks, and a range of other malicious activities,&quot; VPNMentor said in a report.</p><p>&quot;It would be easy for criminals to apply for loans, credit, or other financial crimes using the identity of these individuals and supporting documents.&quot;</p><p>Cybersecurity researcher Jeremiah Fowler, who found the existence of a non-password protected database, authored the report.</p><div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="This image shows a scanned copy of an individual criminologist accreditation, available on the exposed database. Courtesy of VPNMentor" src="https://sa.kapamilya.com/absnews/abscbnnews/media/2023/tvpatrol/04/20/image2.jpg"/><figcaption>This image shows a scanned copy of an individual criminologist accreditation, available on the exposed database. <em>Courtesy of VPNMentor</em></figcaption></figure></div><div><strong>OTHER DOCUMENTS</strong></div><p>In an ANC interview Thursday, Fowler said he also found character recommendations, which came in the form of letters from courts and offices of municipal mayors, and documents containing tax identification numbers (TIN).</p><p>The database also contained internal directives addressing law enforcement officers.</p><p>&quot;I didn&#x27;t see anything that would be a threat to national security, for example,&quot; Fowler told &quot;Rundown&quot;. </p><p>&quot;But these were directives. Anytime you have a message coming from the top down? That&#x27;s potentially sensitive information that you wouldn&#x27;t want in the wrong hands.&quot;</p><p>He noted in his report that &quot;exposed records could also potentially allow criminals to target members of law enforcement for blackmail or other schemes.&quot;</p><div class="embed-wrap"><figure data-feedback="fb:likes,fb:comments"><img alt="This image shows a scanned copy of a police officer’s national police clearance record. Courtesy of VPNMentor" src="https://sa.kapamilya.com/absnews/abscbnnews/media/2023/tvpatrol/04/20/image1.jpg"/><figcaption>This image shows a scanned copy of a police officer’s national police clearance record. <em>Courtesy of VPNMentor</em></figcaption></figure></div><div><strong>&#x27;PUBLICLY ACCESSIBLE&#x27;</strong></div><p>Fowler said that as a cybersecurity researcher, his objective is to help secure any exposed data.</p><p>&quot;To describe it in the most simple way, we used IOT search engine. IOT engine is similar to Google, except it searches for connected devices... In this case, it was a cloud storage repository,&quot; he said.</p><p>Fowler also said the database was &quot;publicly accessible&quot; to anyone with internet.</p><p>&quot;It doesn&#x27;t take specialized knowledge to see this. You just have to know where to look,&quot; he said.</p><p>To authenticate his findings, he only viewed a limited sampling and did not extract any data.</p><p>Fowler has sent 15 responsible disclosure notices to multiple agencies but has not received an official response.</p><p>&quot;It&#x27;s not about naming and shaming and pointing the finger. It&#x27;s about learning from a data exposure,&quot; he said.</p><p>&quot;My best advice would be to learn, to grow and to take inventory of all the databases that you have and who has access to them.&quot;</p><div><strong>PRIVACY WATCHDOG: NO BREACH SAY AGENCIES</strong></div><p>The National Privacy Commission meanwhile met on Thursday with representatives of the agencies named in the alleged leak.</p><p>The NPC said the PNP, NBI, BIR and the Civil Service Commission have conducted their respective investigations and vulnerability tests. </p><p>While the NBI, CSC, and BIR have confirmed that there were no breaches on their part, the PNP requested more time to validate and review its systems for possible security compromise as the police was highlighted in the alleged data leak.</p><p>The NBI has denied the report of a data breach in its system.</p><p>&quot;Based on the initial assessment of our IT people, so far we did not see a breach in our system. But our verification and monitoring are continuous,&quot; NBI spokesperson Atty. Giselle Dumlao said in a statement.</p><div><strong>In a separate statement, Commissioner Romeo Lumagui said the alleged data breach did not happen in the Bureau of Internal Revenue. </strong></div><p>&quot;In reply to the alleged data breach that happened in three government agencies reported in newspapers today, April 20, 2023, Commissioner Romeo D. Lumagui, Jr. would like to assure the general public that the alleged breach did not happen in the Bureau of Internal Revenue (BIR),&quot; the agency said in a statement.</p><p>But the BIR said it is working with the other agencies to mitigate a reported breach.</p><p>“The BIR has been exerting efforts to protect and maintain the security of its data. The Bureau has initiated response protocols to keep its database protected. We are now in close coordination with the authorities and other government agencies to assist in mitigating the reported breach”, Lumagui said. </p><p>For its part, the Philippine National Police said an investigation is underway.</p><p>“The data breach is being investigated by our ACG (Anti-Cybercrime Group). So we just have to wait, what happened at baka napasok yung ating system” said PNP Chief, General Rodolfo Azurin Jr in an interview with Camp Crame reporters.</p><p>The NPC meanwhile said it has ordered Fowler to appear before the<br/>Commission on April 21 to aid their investigation.</p><p>“The recent allegations of a data breach involving law enforcement agencies in the country should serve as a reminder that no organization, not even the government, is immune to the threat of cyberattacks. And that we should remain in constant vigilance in protecting personal data,” said Privacy Commissioner John Henry Naga. </p><p>The NPC added that government agencies, such as the PNP, should strictly comply with the Data Privacy Act of 2012, including the mandatory breach notification requirement under various NPC Circulars.</p><div><strong>COMPROMISED SYSTEM IDENTIFIED</strong></div><p>The Department of Information and Communications Technology said Thursday it has found &quot;possible&quot; compromised systems in some government agencies in the recent investigations of its Philippine National Computer Emergency Response Team (NCERT).</p><p>&quot;NCERT identified several possible compromised systems in some government agencies in the course of its assessment and testing. With the investigation still underway, the Department commits to disclose the results of its probe to the public and relevant government agencies in due time and in a proper forum,&quot; the agency said.</p><p>DICT said the investigations were conducted after it received links to an Azure blob storage containing sample photos of IDs, including PNP and NBI clearances, from an unknown security researcher last February.</p><p>Although the source of the information was not disclosed, it appears to be similar to that of the recently reported by Fowler, it said.</p><p>The DICT said it considers the incident as a grave concern and assures the public that it is committed to protecting the country’s cyberspace from attacks.</p><ul class="op-related-articles">	<li><a href="https://news.abs-cbn.com/video/business/04/20/23/privacy-watchdog-to-discuss-alleged-breach-with-bir-pnp">Privacy watchdog to discuss alleged breach with BIR, PNP</a></li>	<li><a href="https://news.abs-cbn.com/news/04/20/23/over-12m-records-from-ph-agencies-leaked-firm-says">Over 1.2M records from NBI, PNP, other agencies leaked, firm says</a></li></ul><figure class="op-interactive"><iframe allow="autoplay; fullscreen" frameBorder="0" height="100%" id="ivsplayer01" scrolling="no" src="https://player.ivideosmart.com/ivsplayer/v4/dist/html/iframe-src.html?iframeid=ivsplayer01&amp;key=e8c22c015ca9eafa76f1e3edfa03c603&amp;spid=3001339&amp;vid=2589476" width="100%"></iframe></figure><div class="iwantbar">Watch more News on <a href="https://www.iwanttfc.com/#!/browse/Genres/News/tag_id_genres/id_news" target="_blank">iWantTFC</a></div>

Over 1.2 million records, including sensitive information of applicants and employees of government agencies in the Philippines, have been leaked, a firm said.

Over 1.2M records from NBI, PNP, other agencies leaked, firm says | ABS-CBN

Halalan 2025

Entertainment

News

Metro.Style

Lifestyle

Sports

More

Traffic

Horoscope

News

Over 1.2M records from NBI, PNP, other agencies leaked, firm says

Over 1.2M records from NBI, PNP, other agencies leaked, firm says

Davinci Maru,

ABS-CBN News

Published Apr 20, 2023 09:53 AM PHT

|

Updated Apr 21, 2023 07:36 AM PHT

Read More:

data breach

hacking

hackers

vpnMentor

database

National Bureau of Investigation

Philippine National Police

Bureau of Internal Revenue

NBI

PNP

ABS-CBN is the leading media and entertainment company in the Philippines, offering quality content across TV, radio, digital, and film. Committed to public service and promoting Filipino values, ABS-CBN continues to inspire and connect audiences worldwide.

Corporate

Investors

Governance

International Distribution

Corporate

Governance

Investors

International Distribution

NPC Seal of Registration

Privacy Policy

AI Policy

Terms of Service

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.

NPC Seal of Registration

Privacy Policy

Terms of Service

AI Policy

Advertise with Us

© 2025 ABS-CBN Corporation. All Rights Reserved.