National Privacy Commissioner and Chairman John Henry D. Naga ordered an in-depth investigation into the GCash glitch that caused unauthorized transactions in some customer accounts of the country’s leading e-wallet platform. In a statement Saturday, May 13, the National Privacy Commission (NPC) said it is investigating a potential personal data breach involving compromised accounts of the mobile application, GCash. The glitch occurred on May 10, 2023, which forced the temporary halt of GCash app operations. The NPC’s Complaints and Investigation Division (CID) has been closely monitoring this incident since May 9, 2023 amidst circulating reports of GCash users on suspicious transactions on their GCash accounts, to determine the existence of breach and its extent, and whether there are any other violation of the provisions of the Data Privacy Act of 2012. On May 10, 2023, the NPC issued a notice to explain and an order addressed to G-Xchange, Inc. (GXI), the company managing GCash, requiring GXI to appear before the Commission for a clarificatory meeting and to provide additional information and documents. The clarificatory meeting was held on May 12, 2023, wherein GXI presented information to the NPC about their investigation and the measures taken with dispatch to address the incident. The NPC said it will issue another Order instructing GXI to provide further information and documents to enable an independent assessment and verify the claims presented by GXI on the supposed phishing being the cause of the glitch. The NPC, however, did not divulge how many accounts have been compromised and suggested that media queries about it be directed to GCash instead. It not say also if GCash officials disclosed the number of uncompromised accounts during their clarificatory meeting. Nonetheless, Naga continued to assure the public that all necessary steps have been made by the NPC to protect the rights of GCash clients as data subjects. "The NPC is committed to safeguard the privacy of all individuals and will continue to provide guidance on how the public can better protect themselves from violations of their data privacy rights, even as these threat actors are also becoming more sophisticated in the pursuit of their criminal design," Naga stated. He concluded saying, "The NPC will diligently exercise its powers under the law against any party found to be in violation of the Data Privacy Act."