Two Clocks, One Silence: Why the Philippines' Breach Reports Outran Its Notifications

A threat actor using the alias "sinigangmixwithgabi" advertised personnel, payroll and attendance records allegedly pulled from the Department of Transportation's Human Resource Information System, covering about 4,534 employees, while a group calling itself DeathNoteHackers advertised Philippine Coast Guard data with a screenshot showing about 1.35 gigabytes across 6,698 files and 3,411 folders (Source: Philippine News Agency, 2026). On 6 November 2026, the National Privacy Commission said it had received no personal data breach notifications from any of the agencies named the previous day (Source: National Privacy Commission, 2026). Everyone assumes a hacking wave produces notifications; this week the reports arrived and the notifications did not.

The 72-Hour Clock That Nobody Started

NPC Circular No. 16-03 requires a personal information controller to notify the Commission and affected data subjects within 72 hours of knowledge of, or reasonable belief in, a notifiable personal data breach (Source: Rappler, 2026). Deputy Privacy Commissioner and spokesperson Atty. Jose Belarmino II said on 6 November that the Commission had received none "in relation to the reported incidents" (Source: National Privacy Commission, 2026).

Reports of alleged data leaks do not, by themselves, establish that a personal data breach occurred (Source: National Privacy Commission, 2026). A leak report is a claim. A notification is a legal assessment that the claim is notifiable.

What Was Reportedly Named

Deep Web Konek and BetterGov.PH listed the Department of Information and Communications Technology, the Presidential Commission on Good Government, the Vice President's scheduling system, the Department of Labor and Employment's Public Employment Service Office, the Philippine Air Force's clearance system, and Bataan's internal government website (Source: Rappler, 2026). Eastern Visayas State University appeared alongside the Philippine Nurses Association and other nongovernment entities (Source: Rappler, 2026).

BetterGov.PH attributed the Vice President's scheduling system incident to DeathNoteHackers, a claim that remains unverified (Source: Newsbytes.ph, 2026). No agency has confirmed the advertised data came from its infrastructure, and both large datasets remain unchecked (Source: Philippine News Agency, 2026).

Four Days Later, a Different Deadline

The second clock is annual, and it does not care about the first one. The 2025 Annual Security Incident Report is due 10 November 2026, moved from 31 March 2026 by NPC Advisory No. 2026-03 dated 8 September 2026 (Source: National Privacy Commission, 2026).

Every controller and processor must file regardless of classification under NPC Circular No. 2022-04, and a zero-incident report is still a report (Source: Privalex, 2026).

Filing runs through the Data Breach Notification Management System only, and a submitted report can no longer be edited (Source: Privalex, 2026). Four days after the Commission said it had heard nothing, those controllers owed a signed accounting of everything that happened to personal data in 2025. It is not a press statement but a legal record that stops being correctable.

The October Case With a Paper Trail

In late October, the same gap appeared in one incident with a receipt. Hunt.io reported that an operator copied 68.837 GiB from a Philippine government agency's database backups, leaving the transfer log readable on an unauthenticated HTTP directory on port 80, and finished in under 24 minutes on 6 September 2026 (Source: Hunt.io, 2026). The 27 SQL Server backups carried names matching the agency's overseas-employment and migrant-worker systems (Source: Hunt.io, 2026).

The staging host sat at UpCloud Ltd under AS202053; its access log records 543 requests from 76 distinct addresses across a 16-hour, 9-minute window on 6 and 7 September 2026 (Source: Hunt.io, 2026). Hunt.io notified the relevant national CERT before publication (Source: Hunt.io, 2026). The regulator's response came after publication: the NPC said it was investigating and coordinating with the Department of Migrant Workers (Source: Rappler, 2026).

Detection Is Outsourced. Notification Is Not.

A commercial threat-intelligence firm found a government backup store by reading an open directory. The firm, not the agency, told a national CERT. The regulator opened an investigation after the vendor published.

November ran the same way: civilian monitors, not the agencies, named the systems (Source: Rappler, 2026). The 72-hour clock starts on knowledge or reasonable belief, so if knowledge arrives first at a monitoring group, the controller inherits a start time it did not choose.

Detection capacity is distributed across volunteers, researchers and vendors, while the legal duty to notify stays centralized inside the controller. Yano.AI and other Philippine data firms sit in that chain too, reading public claims before any agency statement exists. The bottleneck is not tooling. It is the filing function.

An agency can hold logs, an incident-response retainer and a forensics timeline and still miss the window, because it is triggered by a legal determination, not an alert. Someone has to decide that a set of alleged records is a notifiable breach, and that decision has to survive lawyers, procurement and a form that cannot be corrected.

FAQ

Q: Did the government confirm a breach this week?
A: No. The NPC said on 6 November 2026 that reports of alleged data leaks do not by themselves establish that a personal data breach occurred (Source: National Privacy Commission, 2026).

Q: Who has to file the 2025 ASIR?
A: Every controller and processor, regardless of classification under NPC Circular No. 2022-04, including entities with zero incidents (Source: Privalex, 2026).

Q: When is it due, and where?
A: 10 November 2026, moved from 31 March 2026 by NPC Advisory No. 2026-03, filed only through the Data Breach Notification Management System and not editable after submission (Source: National Privacy Commission, 2026).

Key Takeaway

Two clocks, two keepers. The 72-hour clock belongs to the responder who must make a legal call while the forensic picture is incomplete. The annual clock belongs to whoever signs the ASIR, a document that becomes final on submission. Neither is satisfied by better detection, a press release or a denial.

For every controller filing before 10 November, the test is concrete. If a notification had to go out in 72 hours, who in your organisation would already know enough to sign it? And if the answer is nobody, what exactly is the annual report measuring?

Sources

• NPC: Statement on reported data leaks in government agencies
• Rappler: NPC probing reports of alleged data leaks
• Newsbytes.ph: NPC checking data leaks after Nov 5 reports
• PNA via SunStar: Privacy body verifying reported data leaks
• NPC Advisory No. 2026-03: Additional period for 2025 ASIRs
• Privalex: 2025 ASIR due 10 November 2026
• Hunt.io: Philippine employment agency records stolen
• Rappler: Govt agency databases found, Hunt intelligence report