Nat’l Privacy Commission monitoring online broker’s data security breach

MANILA, Philippines — The National Privacy Commission (NPC) is investigating the possible personal data breach sustained by COL Financial Group Inc., the leading online stock brokerage firm.

The NPC said COL Financial has notified them of a potential data breach to its system last Friday afternoon, in adherence to standard breach reporting protocols set forth in NPC Circular 16-03, on Personal Data Breach Management, NPC commissioner Raymund Enrique Liboro said in a statement.

In the notification, the company said it detected “a possible breach” in its system on Oct. 17 that “may involve some personal client information.”

“At present, COL Financial has been upfront and transparent in handling this incident. This includes notification to the NPC and the affected data subjects within 72 hours upon knowledge or reasonable belief that a breach has occurred,” he said.

“The Commission shall be expecting to receive from COL Financial a full report on the incident within five days. This will aid us more accurately investigate the incident and decide on our further course of action,” Liboro said.

COL Financial has assured the NPC it has taken immediate measures to address the incident, creating a response team to look into the “likelihood of the threat and probable extent of a data breach, if any.”

Along with the notification, NPC said it has received a preliminary report giving additional details of what its breach response team has done as of Friday, including an initial vulnerability scan of its website which showed “favorable” results.

COL Financial said it would also hire a third party group to perform an independent security and vulnerability check of the system.

The online stock broker sent a “Letter From the President” Friday afternoon to all its clients more than an hour after closing of the day’s trading, wherein COL Financial president and CEO Dino Bate informed account holders of their discovery of “a possible breach in our new system involving some personal client information.”