According to The Philippine Star, the Philippine Securities and Exchange Commission (SEC) has confirmed a data breach affecting users of its digital platforms, with potentially exposed data limited to individual accounts' full name, username, email, mobile number, date of birth, gender, address and TIN; the SEC says no passwords or company records were affected and it notified the National Privacy Commission [2]. iThome reports that advocacy group Deep Web Konek first flagged the case and a seller claims 487,318 identity and username records and about 414,000 TINs, while the SEC said it learned of the reports on November 6 and opened an investigation; Fintech News Philippines reports the origin, scope and validity of the records are still being verified [1][3]. The SEC advises users to change the password of any account that shares a password with their SEC account, turn on two-factor authentication where available and monitor accounts for unusual activity [3].
Philippine SEC confirms leak of digital-platform users' personal data and tax IDs
1 min read
- Disclosed
- Nov 9, 2026
- Published
- Nov 12, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- Technology
- Government system
- Attack vector
- Unknown
- Data type
- Contact info
- Actor type
- Unknown
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Government
What to do nowOur advice
The SEC advises users to change the password of any account that shares a password with their SEC account, turn on two-factor authentication where available and monitor accounts for unusual activity [3]
Timeline
Technical details
Remediation
Vendor guidance
- 1Change reused passwords mitigate[3]
Change the password of any online account that shares a password with your SEC account.
- 2Enable two-factor authentication mitigate[3]
Turn on two-factor authentication where available and monitor accounts for unusual activity.
- 3Watch for scam contacts detect[3]
Do not share login details, one-time passwords or verification links, and be wary of contacts asking for personal data.
References
Media3
- [1]iThome2026-11-12Accessed 2026-11-12Snapshot 2026-11-12 sha256 f2fcfe1fe8cb
“駭客宣稱取得487,318筆身分和用戶名稱、電子郵件、手機號碼、出生日期各近49萬筆，以及36萬筆住家地址和41.4萬稅籍編號。”
- [2]The Philippine Star2026-11-10Accessed 2026-11-12Snapshot 2026-11-12 sha256 4c8b1f32465a
“The Securities and Exchange Commission (SEC) has confirmed a data breach on users of its digital platforms.”
- [3]Fintech News Philippines2026-11-10Accessed 2026-11-12Snapshot 2026-11-12 sha256 5511eeeb3263
“The SEC advised users to change the password of any online account that shares a password with their SEC account.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.