Key facts
- An unknown operator copied 68.837 GiB of database backups from the Philippine Overseas Employment Administration, per Hunt.io's analysis of an open staging server.
- The attacker used a Singaporean staging server hosted by UpCloud Ltd, leaving an open directory with tools and logs.
- The National Privacy Commission is investigating whether the Data Privacy Act of 2012 was violated and is coordinating with the Department of Migrant Workers.
- Hunt.io notified CERT Philippines and the Department of Migrant Workers before publishing its findings.
An unknown operator copied 68.837 GiB of database backups from the Philippine Overseas Employment Administration on September 6, 2026, completing the transfer in 23 minutes 46 seconds, according to Hunt.io’s analysis of an open staging server.
The backups related to overseas-employment case management, accreditation, contracts, cashier and LandBank records. Filenames included POEA_EServices, POEA_HelpDesk, POEAHelpDeskDB, OFW, OfwDB and variants for accreditation, repatriation, eContracts, Cashier and LandBank.
Hunt.io said it has not attributed the attack to a nation-state or criminal group, and that Chinese language fragments found were in third-party code. The researcher also said it did not examine the backup contents and could not confirm what information they held or how the attacker initially gained access.
Investigators have not determined whether personal information was in the copied files or whether anyone accessed the material after copying. The National Privacy Commission is investigating whether anyone violated the Data Privacy Act of 2012 and is coordinating with the Department of Migrant Workers. The privacy regulator has not said how many people, if any, the incident affected.
The stolen data has not appeared for sale on the dark web, according to Hunt.io. Gulf News says the case raises concerns for overseas Filipino workers who used government employment services, with no confirmation anyone exposed their personal records.
Hunt.io notified CERT Philippines and the Department of Migrant Workers before publishing its findings. Hunt.io notified the relevant national CERT before publication. Its report includes no personal records or credentials taken from affected systems. The Department of Migrant Workers and the Department of Information and Communications Technology have not released a public statement on the breach.
Attackers used GodPotato and SeImpersonate privilege escalation tools and the Impacket network library for Python. GodPotato turns service account rights into full SYSTEM control through DCOM and RPC without a Windows vulnerability.
The operator’s PowerShell stager reconstructs the payload in memory using base64 fragments (an encoding format that represents binary data as text), keeping every DLL (dynamic-link library) off the disk. The operator used a Singaporean staging server hosted by UpCloud Ltd, leaving an open directory with tools and logs.
Access logs record 543 requests from 76 distinct addresses over a 16-hour, nine-minute span on September 6 and 7, 2026. The address that retrieved the loader and both payloads uses the domain apps.dmw.gov.ph, while the address that downloaded the source archive 11 times uses the domain legalassistance.dmw.gov.ph.
Hunt.io logs show the backup copy finished at 01:26:50 on September 6, 2026, while the first payload retrieval occurred at 21:41:33 that same day, about 20 hours later, so the payload was not used to steal the backups. Hunt.io researchers called the payload engineering competent but the operational security poor because the operator left the staging server and logs open.
In August 2026, Hunt.io found another threat actor’s workspace holding 1.2GB of data taken from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor. Philippine police arrested a small-town mayor who was a Chinese national posing as a Filipina citizen operating a cyber-scam center. The National Intelligence Coordinating Agency identified 234 data breaches in high-level government agencies in 2025.
Latest Philippine Statistics Authority data places the number of overseas Filipino workers at 2.05 million. Republic Act No. 10173 carries the title Data Privacy Act of 2012 and brings fines and jail time for mishandling personal data.
Hunt.io says governments across the region should scan their own networks and reduce their attack surface. Hunt.io says employees holding excessive privileges let attackers use tools such as SeImpersonate to reach more network assets. The migrant-worker portal exposed risky ports including SMB on 445 and WinRM on 5985 and 47001. “still a breach, since the data was copied out of the agency’s control and the log shows the transfer completing.” — Esteban Borges, head of research for Hunt.io
Join the discussion