GCash was made aware of an online post that GCash user information is being sold on the dark web.

GCash denies this, claiming the alleged datasets do not match with GCash’s records.

“The security and privacy of our users remain our highest priority,” GCash said in a statement. “We take these allegations seriously and immediately launched an investigation with our cybersecurity experts and relevant authorities to verify the authenticity of these claims.”

GCash goes on to explain that the dataset includes users who are not GCash users and many entries appear “incomplete, inconsistent, or invalid.”

“At this time, there is no evidence of any breach in GCash systems,” the statement said. “All customer accounts and funds remain secure.”

The National Privacy Commission (NPC) has cautioned the public to remain vigilant following reports of the GCash data leak, which was first posted on October 26.

The leak was alleged to contain user information, including merchant and user data, account numbers, linked bank and virtual card accounts, and KYC (Know Your Customer, which would have user’s Philippine valid IDs, containing full names, birthdays, addresses, and employment details.)

While GCash ensures that user data is safe, NPC has recommended to “actively monitor their accounts, regularly update their MPINs and passwords, and enable additional security features to protect their information. They must also remain alert to phishing attempts and refrain from sharing personal or sensitive data while the investigation is ongoing.”