Downloading compromised data may pose serious consequences, NPC warns
By Sonny Daanoy
At A Glance
- Anyone who downloaded these files may be held liable for "unauthorized processing," with severe penalties, including imprisonment and fines in millions.
- He confirmed that the Philippine Statistics Authority (PSA) has filed a personal data breach notification.
- He assured the public that the NPC is actively investigating the data breach involving PhilHealth.
The National Privacy Commission (NPC) issued a public warning on Friday, Oct. 13, about the risks of downloading hacked data files from the Philippine Health Insurance Corporation (PhilHealth) ransomware attack.

"The National Privacy Commission reminds everyone not to download the data leaked by the ransomware group out of mere curiosity," NPC-Complaints and Investigation Division Chief Michael R. Santos said in a mix of English and Filipino in PTV's Bagong Pilipinas Ngayon.
Santos emphasized that anyone who downloaded these files may be held liable for "unauthorized processing," with severe penalties, including imprisonment and fines in millions.
READ:
https://mb.com.ph/2023/10/9/dict-warns-against-opening-files-from-phil-health-ransomware-attack
PSA data breach
Meanwhile, he confirmed that the Philippine Statistics Authority (PSA) has filed a "personal data breach notification."
READ:
"This is just the initial step. We will be requiring them to submit a more comprehensive report, providing details on which data were involved and the nature of the breach," he said.
"At this point, we are conducting an investigation and verifying all the information that has been reported to us," he added.
RELATED STORY:
https://mb.com.ph/2023/10/11/psa-probes-data-leak-national-id-civil-registry-unaffected-1
Breached personal information risks
Santos noted that the breached personal information can be used for identity theft and in different kinds of scams—email, text, or call scams.
"There are many types of phishing and smishing," Santos said.
"You might receive a message, text, or call that appears to be from someone you know, but it's not, with the intention of gathering more information, possibly personal information like OTPs (one true pairing) or PINs (personal identification number), to affect your e-wallets and online banking," he added.
Furthermore, he reminded the public that if they encounter related incidents, they can report them to the NPC using the phone numbers and email addresses available on its website.
Santos also encouraged public and private institutions to ensure the safety of the public's personal information, emphasizing the importance of not only cybersecurity measures but also physical security.
"Physical security measures like locks, cabinets, and other security measures are important because not all personal information is stored on computers; there are still paper-based records that need protection," he said.
Still under investigation
Furthermore, he assured the public that the NPC is actively investigating the data breach involving PhilHealth.
"The investigation is ongoing, and we will continue to examine and determine the security gaps that led to this breach," he said.
"We will also determine the accountability of PhilHealth and responsible officers, as well as the hackers, especially in relation to our Data Privacy Act," he added.