Acer Philippines confirms employee data breach through third-party vendor

Acer Philippines has confirmed a data breach involving employee information following an attack on a third-party vendor managing the company’s employee attendance data. The breach, disclosed by a threat actor known as ’ph1ns’ on a hacking forum, has raised concerns about data security protocols within the Taiwanese computer hardware giant.

The attack, which involved no ransomware or encryption, was characterized as a pure data theft incident by the threat actor. Despite claims of not seeking extortion, evidence presented by ’ph1ns’ suggests that data on the breached servers was wiped before access was lost.

A spokesperson from Acer Philippines confirmed the breach to BleepingComputer, clarifying that while the compromised data belonged to their employees, it was not directly obtained from the company’s systems. The company reassured that no customer data was affected, and there was no evidence of a breach in Acer’s systems.

In response to the incident, Acer Philippines issued a public statement emphasizing customer data security and affirming their systems’ uncompromised state. Additionally, Acer has notified the National Privacy Commission (NPC) and the Cybercrime Investigation and Coordinating Center (CICC) in the Philippines, initiating an investigation into the breach.

This breach adds to Acer’s history of security incidents, including a breach in February 2023 involving technical manuals and software tools and compromised customer data from its India-based after-sales service in October 2021. Notably, Acer was previously targeted by a REvil ransomware attack in March 2021, demanding a record-breaking ransom payment of $50 million.