Privacy body warns legal actions vs. PhilHealth officials over data breach negligence

Metro Manila (CNN Philippines, October 7) — The National Privacy Commission (NPC) has launched a further investigation into the cyberattack on the state health insurer, warning legal actions against officials over possible negligence.

The NPC Complaints and Investigation Division found that the data leak on the Philippine Health Insurance Corporation (PhilHealth) involved “a staggering 734GB worth of data, including personal and sensitive personal information.”

“In light of these findings, the NPC has launched a sua sponte investigation to ascertain the full scope of this breach, identify the responsible officials, and recommend legal prosecution to the fullest extent permissible by law,” the NPC said in a statement.

Hackers began exposing some PhilHealth data, including personal details on employees, on the dark web early this week after the government failed to pay $300,000 (roughly ₱17 million) in ransom money.

The commission added that PhilHealth could be held accountable for the incident as the data breach may have been caused by the expired antivirus software.

“The NPC will leave no stone unturned in its investigation into the potential negligence of PhilHealth officials and explore whether any efforts have been made to conceal pertinent information,” it said.

It also warned the public that anyone who is caught processing, downloading, or sharing the exfiltrated data from PhilHealth “will be held accountable for unauthorized processing of personal information and may face criminal charges.”