After PhilHealth, PSA suffers data breach

MANILA, Philippines — The Philippine Statistics Authority (PSA) is next to suffer a data breach staged by cyber hackers, after the successful Medusa ransomware attack on Philippine Health Insurance Corp. (PhilHealth).

The National Privacy Commission, through Public Information and Assistance Division chief Roren Marie Chin, confirmed yesterday that the PSA has suffered a data breach and has filed a breach notification report.

While declining to confirm the cyber attack on PSA, Department of Information and Communications Technology (DICT) Secretary Ivan John Uy said the agency is investigating the case.

Uy said the attack did not involve ransomware like the Medusa’s on PhilHealth but is basically a data breach.

PSA has launched a probe on the alleged data leak, with initial evaluation showing the breach is limited to its Community-Based Monitoring System.

The CBMS is a technology-based system of collecting data used by local government units for their planning, implementation, assessment and intervention activities, as well as by the Department of Social Welfare and Development for targeting households to be enrolled in their social protection programs, including the Pantawid Pamilyang Pilipino Program.

“The PSA assures the public that the Philippine Identification System and the Civil Registration System have not been affected,” the statistics agency said.

It said an assessment is being undertaken on what personal data from the CBMS may have been compromised, and information would be shared with relevant authorities and the public.

The PSA also said additional preventive and containment measures are being implemented to ensure the security and integrity of all systems and data bases, part of which is to shut down and isolate the CBMS.

It warned social media posts with the alleged sample data include links that contain malware that may be used by cybercriminals and bad actors to perpetuate other illicit acts.

Meanwhile, De La Salle University (DLSU) has suffered a “data security incident” that has left some of its online systems inaccessible while university administration deals with possible cybersecurity compromise.

The LaSallian, the university’s official