The Philippines’ privacy regulator is investigating the loss of some 68GB worth of citizen data, after the attacker who took it left the evidence of the theft in the wild.
The National Privacy Commission (NPC) said Thursday it is “aware of the matter and is conducting an investigation”. The NPC is working with the Department of Migrant Workers (DMW) to determine whether the Data Privacy Act of 2012 was violated.
Researchers with Hunt.io say an operator copied 27 SQL Server backups, 68.837 GiB in all, whose filenames match systems run by the DMW. That’s the agency that absorbed the old Philippine Overseas Employment Administration (POEA) and handles transactions and personal data from citizens who have taken work abroad.
Ang Gulo! Philippines Probes Theft
In this case, the theft came to light not through anything the government office itself caught, but through sloppy opsec on the part of whoever took the data. The Hunt.io team says it found an exposed staging server, a rented box at UpCloud in Singapore, that served the operator’s working folder to anyone who asked, logs and all.
DMW data breach: key questions
What is the DMW data breach?
On Sept. 6, 2026, an attacker copied 27 SQL Server database backups, 68.837 GiB in all, whose filenames match overseas-employment systems run by the Philippines’ Department of Migrant Workers (DMW). Researchers at Hunt.io found the theft through the attacker’s own transfer logs, left on an exposed server.
Who is investigating?
The Philippines’ National Privacy Commission (NPC) is investigating whether the Data Privacy Act of 2012 was violated and is coordinating with the DMW. Hunt.io says it notified the national computer emergency response team before publishing its findings.
Was OFW personal data stolen?
That has not been established. The backups were copied, but Hunt.io did not open them, and neither the DMW nor the Department of Information and Communications Technology has publicly said what they contain.
Who is behind the attack?
No one has been identified. Hunt.io does not attribute the theft to any known group. A hacktivist group called HappyGoLuckyPH separately claimed access to DMW systems in September, but no link between the two has been established.
Don’t file this under somebody else’s problem. The privilege-escalation trick in the operator’s kit needs no Windows vulnerability at all. It’s a public tool that turns an ordinary service account into full SYSTEM control on a default Windows server, which Hunt.io flags as the part of this operation most likely to show up elsewhere. That makes it a configuration problem, not a patching one, and the same Windows and Active Directory plumbing runs most US agency and corporate networks.
According to the operator’s own transfer log, the copy wrapped up in under 24 minutes on Sept. 6. Sitting beside it was the toolkit: a lightly rebranded build of the public GodPotato privilege-escalation tool, a PowerShell stager and a full Impacket environment.
The Agency’s Own Servers Came Calling
The access log adds a twist. That same evening, the loader and both payloads were pulled by an address hosting apps.dmw.gov.ph. A second address, tied to the agency’s legal-assistance portal, grabbed the source archive. Both present a wildcard certificate issued to POEA. Hunt.io is careful here. The log shows the tools were delivered to those machines, not that anything ran on them.
A Day Later: A Hacktivist Claim
The timing is hard to ignore. On Sept. 7, the day after the copy, the Department of Information and Communications Technology (DICT) said its national CERT was responding to unauthorized access on the DMW website. A hacktivist group calling itself HappyGoLuckyPH claimed the defacement. It also said it had sat in the agency’s Active Directory for more than a month, eventually took a domain controller, and could reach repositories that included database backups.
Nobody has tied the two incidents together. Hunt.io doesn’t mention the group, and DICT never addressed the group’s claims about how deep or how long the intrusion ran. But Hunt.io’s operator was carrying tooling built for Active Directory work, including a script that hunts for domain controllers. And the backups were gone before any payload was fetched, so whoever took them already had all the access they needed.
It isn’t the agency’s first rodeo, either. In July 2024, a ransomware attack forced DMW to pull its online systems offline. The agency said at the time that its OFW databases were untouched.
The Theft Is Certain. The Rest Isn’t
The theft itself, however, is not in doubt. Hunt.io describes a completed copy. What remains unknown is how the operator got in, what ran on the agency’s servers, and where the data ended up. The researchers haven’t opened the backups, and neither DMW nor DICT has publicly said what was in them.
The operator’s carelessness is the only reason anyone knows about this; nobody detected the breach. And with nearly eight weeks between the theft and Hunt.io’s report, the data has had plenty of time to travel.
Why OFW Data Matters
The data in question could also be more sensitive than many would first expect. The backup names point to OFW case management, electronic contracts, Balik-Manggagawa processing for returning workers, repatriation, adjudication, cashier and LandBank systems. Hunt.io notes several of those mappings rest on filenames alone.
This data breach could be particularly damaging for the Philippines, as the country has consistently been listed as one of the largest recipients of remittance payments from overseas workers to family members. The World Bank ranked it fourth in 2023. The central bank says cash remittances hit a record $35.63 billion in 2025, roughly 7.3 percent of GDP.
Those systems serve a big population. The Philippine Statistics Authority estimated 2.16 million overseas Filipino workers in 2023. The researchers stress that’s the population the systems cover, not a count of records in the stolen backups.
No Attribution, No Answers Yet
Hunt.io says it notified the national CERT before publishing. It does not attribute the attack to any known group. Its report flags Chinese-language comments in the operator’s code but explicitly declines to read anything into them.
[See Related: The Impossible Omelette: Chinese APT Delivers ‘EggStreme,’ a Fileless Malware Invisible to Antivirus]
Security Point Break has asked the DMW and DICT what the backups contain and whether the theft is connected to the September intrusion. Neither had responded by publication time. This story will be updated if they do.
