Philippine Statistics Authority (PSA) experiences data breach following PhilHealth cyber attack

The Philippine Statistics Authority (PSA) has become the latest data breach victim, marking the second cybersecurity incident in the country, following the Medusa ransomware attack on the Philippine Health Insurance Corp. (PhilHealth).

The National Privacy Commission (NPC), represented by Public Information and Assistance Division Chief Roren Marie Chin, confirmed the PSA’s data breach and reported that the agency had already submitted a breach notification.

While not explicitly confirming the cyberattack on the PSA, the Department of Information and Communications Technology (DICT) Secretary, Ivan John Uy, revealed that the agency is actively investigating the incident. According to Uy, this breach does not involve ransomware, unlike the Medusa attack on PhilHealth; instead, it is primarily categorized as a data breach.

The PSA has initiated an internal investigation into the alleged data leak, with initial findings indicating that the breach is confined to its Community-Based Monitoring System (CBMS). The CBMS is a technology-based system utilized by local government units for data collection, aiding in their planning, implementation, assessment, and intervention activities. It is also used by the Department of Social Welfare and Development to identify households eligible for social protection programs, including the Pantawid Pamilyang Pilipino Program.

In an official statement, the PSA reassured the public that the Philippine Identification System and the Civil Registration System remain unaffected by the breach. The agency is evaluating the extent to which personal data from the CBMS may have been compromised and will share this information with relevant authorities and the public.

The PSA is implementing additional preventive and containment measures to safeguard the security and integrity of all systems and databases, which includes temporarily shutting down and isolating the affected CBMS. It has also cautioned against using alleged sample data from social media posts, which may contain malware that cybercriminals can exploit.