The Philippine Securities and Exchange Commission said personal information tied to registered users of its online platforms was compromised, and that it has formally reported the incident to the National Privacy Commission.

According to the regulator, the exposed data includes full names, usernames, email addresses, mobile numbers, dates of birth, genders, physical addresses and Tax Identification Numbers. The SEC said its review so far found no leakage of passwords and no impact on corporate filings.

What the SEC disclosed

The commission confirmed the breach on Monday, saying the incident involved personal data from users registered on its online systems. The disclosure focused on information connected to platform accounts rather than records filed by companies.

The SEC said an internal assessment showed that passwords stored in its databases were not exposed. It also said system data was not altered or destroyed as a result of the incident.

Possible source remains under review

The regulator said the source of the leak has not been definitively established. Based on its initial assessment, the compromised data may have come from malware infections or from unauthorized third-party access aimed at individual devices used to sign in to SEC online portals.

The agency said the investigation is continuing to verify the dataset’s origin, its scope and whether the material being reviewed is valid.

Containment and security measures

As part of its response, the SEC said it has tightened access controls, updated authentication credentials and carried out security scans across its infrastructure.

Those steps were announced alongside the formal notification to the National Privacy Commission, which the SEC said it had already made after confirming the compromise of user information.

Advice for affected users

The commission urged users to change passwords on any other services where they may have reused the same credentials. It also recommended enabling multifactor authentication, scanning personal devices for malware and watching accounts for suspicious messages or unauthorized transactions.

The SEC added that it does not ask users to provide passwords or security PINs. The next confirmed step is the continuation of the investigation as authorities work to determine the breach’s full origin and extent.

Source: bitpinas.com