Threat watch / Breach
Philippines SEC: personal data of online platform users exposed, tax IDs included
On November 9, 2026, the Philippines' Securities and Exchange Commission (SEC) confirmed a data breach affecting users of its digital platforms, after the group Deep Web Konek flagged a forum listing of about 487,000 lines of SEC-linked data on November 5. The SEC's notice to users lists names, usernames, emails, mobile numbers, birth dates, addresses and tax identification numbers (TIN). It says no passwords leaked and no company records were affected, and it has notified the National Privacy Commission. It has not said how many people are affected.
- Sector
- Government & politics
- Way in
- Not public yet
- Product or vendor
- None named
- How it happened
- Not established. The SEC's public statement gives no cause and does not name the systems involved. Its email to users says the accounts "may have been leaked potentially through malware infection or unauthorized access by a third party threat actor" of the user's own device, without saying how it reached that view. A security professional quoted by Radar criticised this as blaming the users.[1][2][3] Checked 11 Nov 2026
- What was stolen
- According to the SEC's notice to users: full names, usernames, email addresses, mobile numbers, dates of birth, gender, addresses and tax identification numbers (TIN). The SEC says no passwords were leaked, no data was modified and no company records were involved.[1][3][4] Checked 11 Nov 2026
- Who was impacted
- Individuals registered on the SEC website for filings and document requests. The SEC has not released the number of affected users.[1][3] Checked 11 Nov 2026
- Threat actor
- Not attributed
Timeline
- Deep Web Konek flags a forum post titled "Philippines Securities and Exchange Commission data 487K Lines", with a download link. Its authenticity has not been independently established. [2][3]
- The SEC detects the incident, according to its statement. [2][3]
- The SEC confirms the breach, emails affected account holders, and formally notifies the National Privacy Commission. It says it is "conducting a thorough investigation" and advises users to change their passwords and scan their devices. [1][2][3][4]
- Radar reports criticism that the SEC's user notice blames the users' own devices, and notes that the public statement did not mention the suspected cause given in the email. [3]