The National Privacy Commission (NPC) has confirmed that the security breach on multiple GCash accounts resulted from the utilization of “phishing” attacks. On Wednesday, May 24, the country’s personal data privacy watchdog said that it has already concluded its extensive investigation after careful examination and independent verification into the reported unauthorized transactions involving multiple GCash accounts. “Upon our thorough investigation, we have determined that the unauthorized transactions in GCash accounts were a result of a meticulous phishing scheme,” Privacy Commissioner John Henry D. Naga said in a statement. Phishing is a type of online scam that targets consumers by sending them an e-mail that appears to be from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers. "Unknown threat actors took advantage of vulnerable GCash users, triggering the phishing scheme through online gambling websites such as 'Philwin' and 'tapwin1.com'," the Privacy Commissioner added. Initiated on May 09, 2023, the NPC's Complaints and Investigation Division (CID) conducted an independent investigation to ascertain the extent of the alleged unauthorized transactions and determine if there is a possible compromise of personal data and other potential violations of theData Privacy Act of 2012. On May 12, 2023, the NPC held a clarificatory meeting with G-Xchange, Inc. (GXI), providing information gathered from their internal investigation and outlining the measures taken to address the incident. The NPC raised concerns and requested additional information and proof from GXI to enable the conduct of an independent assessment and verify the company's claims. Subsequently, on May 19, 2023, GXI submitted its compliance with the orders issued by the NPC. "We have ordered GXI to intensify its education and awareness campaign to its clients to prevent similar incidents in the future,” Privacy Commissioner Naga disclosed. “We assure the public that the National Privacy Commission remains resolute in its mandate to safeguard the rights of data subjects and protect personal information. We will employ the full extent of our powers under the law to penalize those who violate the Data Privacy Act of 2012,” the Privacy Commissioner asserted. The NPC is committed in promoting a safe and secure digital environment for all Filipinos and urges everyone to remain vigilant against phishing attacks that would compromise their personal information.