EDITORIAL — Digital vulnerability

An anti-cyber scam advocacy group is urging the public to prepare for the worst as the Medusa ransomware group began leaking on Thursday data hacked from the Philippine Health Insurance Corp. PhilHealth has been reassuring the public that its membership data is secure, but has acknowledged that it has yet to determine the full extent of the breach.

PhilHealth has downplayed the threat posed by the Medusa gang and its demand for $300,000 or about P17 million in ransom to unlock the data that was accessed in an attack on Sept. 22. Initially claiming that the situation was under control, PhilHealth said only application servers and employees’ workstations were affected by the ransomware attack, but not the membership database.

On Oct. 3, an official of the Department of Information and Communications Technology reportedly said those application servers and employees’ workstations may contain member information. The data leaked reportedly included not only PhilHealth employees’ identification cards, but also copies of employees’ payroll and information pertaining to their “regional offices, memos, directives, working files… hospital bills.”

PhilHealth has said user data including names, addresses, dates of birth, sex, phone numbers and of course PhilHealth ID numbers were compromised. Cyber security experts have warned that the data can be used for scams or identity theft, with PhilHealth employees most vulnerable.

The data breach has raised alarm over the vulnerability of the government’s digital network to hacking. The issue is critical as the government touts its shift to digitalization and e-governance, with the public pushed to embrace digital technology.

Digitalization, when it works, promotes efficiency and cuts corruption. But the shift to e-governance calls for adequate and secure digital infrastructure, with sufficient trained manpower to prevent data breaches. The network must be inter-operable across all national and local government agencies, unlike the disjointed digital contact tracing platforms operated by the national government and a few local government units during the COVID pandemic.

These requirements are lacking or missing in the Philippines.