NPC launches online tool for PhilHealth data breach detection

MANILA, Philippines — The National Privacy Commission (NPC) on Friday launched the "PhilHealthLeak Search Tool" portal, which allows members of Philippine Health Insurance Corp. to determine whether their data was compromised in the cyberattack that targeted the country's national health insurer.

In September, a massive cyberattack targeted PhilHealth, leading to the theft of personal data from potentially millions of individuals. As a result, the insurer urged its members to change their passwords due to the severity of the attack.

The website, according to the NPC, was created by the privacy commission in alignment with its data protection responsibilities outlined in the Data Privacy Act of 2012 (DPA). 

"The primary purpose of this search tool is to empower data subjects to take proactive steps to further protect themselves from the risks associated with a personal data breach such as identity theft, financial fraud, phishing attacks, blackmail and extortion, medical identity theft, reputational damage and loss of privacy," the NPC said.

"This webpage only requires the input of the 12 digit identification number. More specifically, it allows users to check whether their personal data may have been compromised in the incident involving Philippine Health Insurance Corporation files made available online on 5 October 2023 purportedly by the Medusa Ransomware Group," it added. 

Although the tool is useful for addressing data breaches, the NPC warned about its its limitations. The privacy commission highlighted the following key points:

The NPC-developed online tool can be accessed here.