EDITORIAL - Data breach

As of yesterday, 23 government agencies led by the Office of the Vice President and the Bureau of Internal Revenue along with private institutions were reported to have suffered data breaches.

Between Nov. 5 and 7, the leaked data – including private files, personnel records and internal datasets – had been uploaded to the dark web and hacker forums, according to cybersecurity advocacy group Deep Web Konek.

Several of the 23 institutions have since confirmed the data breach of varying extents. The OVP said its affected platform did not contain confidential information. The Securities and Exchange Commission, on the other hand, advised users to change passwords even if its central database remained secure. The SEC also notified the National Privacy Commission about the breach.

Deep Web Konek reported that other agencies attacked included the Department of Information and Communications Technology, the Department of the Interior and Local Government, Department of Labor and Employment and the Philippine Coast Guard.

The BIR, the Philippine Air Force and the Armed Forces of the Philippines are still verifying the reported data breach. The BIR has coordinated with the DICT and police Anti-Cybercrime Group to validate if taxpayer records of over 10 million people had indeed been compromised.

Cybersecurity experts noted that most of the data breaches were flagged on Nov. 5, marking “Operation Vendetta” or the “Million Mask March” during which coordinated cyberattacks are carried out by certain groups.

Deep Web Konek reported that leaked PDF files from the OVP, allegedly with a total size of 10 gigabytes, were posted in an underground cybercrime forum. The post reportedly included criticisms of the government over the national budget corruption mess and anomalous public infrastructure projects.

The hacking should be regarded as an opportunity to tighten guardrails for digital data. This is critical particularly as the government carries out President Marcos’ directive to speed up the shift to e-governance.

Digital systems speed up the delivery of services and plug opportunities for corruption as human intervention and discretion are drastically reduced. But the system needs sufficient and regularly updated infrastructure for seamless operation. So far, this has not been the case in several agencies that are shifting to e-governance.

Besides ensuring that digital systems are working, the data must be protected. The latest data breach can expose the weaknesses that need to be addressed ASAP.