The Cybercrime Investigation and Coordinating Center (CICC), the government unit overseeing cybercrime prevention, rejected reports of a data breach involving mobile wallet giant GCash following its investigation.

In a statement, the CICC said it immediately launched an investigation after receiving reports of an alleged data leak at G-Xchange, the operator of GCash.

On Monday, Oct. 27, a post that was linked to a dark web forum claimed that it was selling highly sensitive information linked to GCash accounts, such as names, addresses, and even employment information.

The “threat actor,” as described by the National Privacy Commission (NPC), reportedly offered information on eight million users of the mobile wallet.

The NPC, in a statement, said it has launched an investigation into the matter, noting that it will take regulatory and enforcement action should it confirm that personal data was compromised.

GCash, for its part, said initial findings show that the alleged data breach did not originate within its system, noting that many of the leaks appear incomplete, inconsistent, or invalid.

“At this time, there is no evidence of any breach in GCash systems. All customer accounts and funds remain secure,” it said in a statement on Monday.

The CICC, through coordination with GCash, echoed the assessment that the data propagated online by the threat actor appears to be “recycled information.”

This means that the information was older or previously available data that was either “reused or reshared” to appear as newly compromised material.

“Further examination also shows that the datasets in question do not originate from GCash’s systems,” the CICC said.

“These findings suggest that there has been no recent compromise of GCash’s infrastructure,” it explained.

In pursuit of verification, GCash said it is open to system checks by the CICC and the Department of Information and Communications Technology (DICT) to ensure there are no potential points of compromise.

The CICC, meanwhile, said it is actively pursuing a lead on the possible individual or group behind the reported exposure.

It added that it is also working on the verification of the origin of the uploaded data and establishing any link to previous cyber incidents.