DICT Press Statement on Multiple Cyber Threats Detected ...

𝐃𝐈𝐂𝐓 𝐏𝐫𝐞𝐬𝐬 𝐒𝐭𝐚𝐭𝐞𝐦𝐞𝐧𝐭 𝐨𝐧 𝐌𝐮𝐥𝐭𝐢𝐩𝐥𝐞 𝐂𝐲𝐛𝐞𝐫 𝐓𝐡𝐫𝐞𝐚𝐭𝐬 𝐃𝐞𝐭𝐞𝐜𝐭𝐞𝐝 𝐀𝐜𝐫𝐨𝐬𝐬 𝐕𝐚𝐫𝐢𝐨𝐮𝐬 𝐆𝐨𝐯𝐞𝐫𝐧𝐦𝐞𝐧𝐭 𝐀𝐠𝐞𝐧𝐜𝐢𝐞𝐬 | 𝟎𝟕 𝐒𝐞𝐩𝐭𝐞𝐦𝐛𝐞𝐫 𝟐𝟎𝟐𝟔

The Department of Information and Communications Technology (DICT) Cybersecurity Bureau, through the National Computer Emergency Response Team (NCERT), confirms that it is actively responding to multiple cyber threats detected across various government agencies. These include unauthorized access to the website of the Department of Migrant Workers (DMW), a web defacement incident involving the Department of Labor and Employment (DOLE), and an alleged ransomware attack affecting the Philippine Ports Authority (PPA).

In response to the unauthorized access detected on the DMW website, the DICT activated emergency incident protocols through direct coordination and on-site technical response with the DMW Management Information Technology Service (MITS). Joint technical teams immediately implemented access-control hardening and system isolation measures in aid of the ongoing forensic investigation and system recovery.

Upon detecting the unauthorized modification on the DOLE web host, the DICT promptly notified DOLE IT administrators and initiated coordinated response protocols. Designated agency focal persons confirmed that primary system and access-control measures were immediately enforced to isolate the affected node, support ongoing digital forensics, and facilitate safe system restoration. Initial technical assessments confirm that no sensitive databases or Personally Identifiable Information (PII) were compromised.

As a precautionary measure to ensure complete threat eradication and security hardening, the affected web services at DMW and DOLE have been temporarily taken offline. NCERT and agency technical teams are actively collaborating to finalize root-cause investigations and safely restore full web service availability.

Following reports alleging a ransomware attack targeting PPA systems, NCERT promptly alerted agency administrators via an official incident report. During a subsequent technical assessment, joint logs with the agency’s designated focal personnel verified that the report was a false positive, confirming that no ransomware activity or system compromise occurred within PPA infrastructure.

Investigation and mitigation procedures continue to be actively conducted by technical teams from the DICT and partner agencies. Securing our national network infrastructure and preserving the confidentiality, integrity, and availability of public information remain our highest priority. Further verified technical updates will be provided as recovery milestones are completed.

Maybe check also the email servers of DOST-PCHRD for unauthorize access.