The National Privacy Commission (NPC) has confirmed that there was no breach of personal data involving mobile wallet giant GCash, based on the findings of its investigation into the alleged data leak.

The NPC said it has concluded its investigation into the issue, finding that there was “no sufficient basis to conclude that a personal data breach occurred” within G-Xchange Inc., the operator of GCash.

This is in connection to a post made on a dark web forum that claimed it has highly sensitive data of up to eight million GCash users.

The supposed dataset leak, which was reportedly up for sale online, included information such as users’ names, addresses, and employment details.

The NPC immediately initiated an inquiry upon discovery of the post, which was then followed by an order to GCash to submit technical documentation and preserve system logs.

The NPC said it also told the mobile wallet to appear in a clarificatory conference and live technical demonstration before its complaints and investigation division. GCash was able to comply with such requirements.

In its independent validation, the commission found that the dataset circulating online was inconsistent with GCash’s verified data structures.

“Several of the listed accounts were found to be invalid or inactive, and no indicators of unauthorized access, infiltration, or data exfiltration were detected within GCash’s monitored environments,” it said.

A live technical demonstration of GCash’s system also indicated that there were no unauthorized access attempts to the e-wallet’s critical databases, such as those related to users.

“The demonstration, which covered the period from 1 January 2025 to 29 October 2025, returned zero events, confirming that only pre-approved internal IP addresses interacted with the system,” the NPC said.

“This strongly indicates that no breaches, unauthorized access, infiltration, or exfiltration attempts occurred,” it added.

GCash earlier assured users that their accounts and funds are safe, after the initial investigation of the Cybercrime Investigation and Coordinating Center (CICC) also found that its systems were not breached.

The CICC said the alleged data lack appeared to be “recycled information” that was reused to appear as newly compromised material.

GCash has since cautioned the public to avoid posting unverified information online and instead rely only on official channels for accurate updates.

The company said it is ready to pursue legal action against individuals or groups spreading malicious or false claims against the mobile wallet that cause public confusion and undermine user trust.