Back Darkreading

Philippine Migrant Worker Data Likely Leaked in 69GB Breach

Darkreading • November 4, 2026

Breaking cybersecurity news, news analysis, commentary, and other content from around the world, with an initial focus on the Middle East & Africa, the Asia Pacific, Europe, and Latin America.

An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.

An unknown threat actor managed to gain access to sensitive databases belonging to the Philippine Overseas Employment Administration, exfiltrating nearly 69GB of information on workers, contracts, and financial records, according to an analysis of a staging server used in the breach.

Over 24 minutes, the attacker copied 27 backup databases with information on overseas-employment case management, including accreditation, contracts, and cashier and LandBank records, according to threat intelligence firm Hunt.io's Oct. 28 analysis of the logs found on a Singaporean staging server used by the attacker. The cyberattackers used privileged escalation tools, namely GodPotato and SeImpersonate, and the Impacket network library for Python to move the data, but the trail stopped at the staging server, says Esteban Borges, head of research for Hunt.io.

The server had been later accessed, but by who is not clear, Borges says. While Hunt.io has not yet discovered the data as advertised for sale, the information may have been detected and removed, but that seems unlikely, he says.

Related: State Bank of India Suffers a Customer PII Data Leak

"I won't claim the backups stopped on the staging server," he says, so it's "still a breach, since the data was copied out of the agency’s control and the log shows the transfer completing."

This is not the first time that cybersecurity firms have found evidence that Philippine government data had been stolen. In August, Hunt.io discovered another threat actor's workspace hosting a number of tools and, in that case, 1.2GB of data stolen from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor. A year ago, Philippine police arrested the mayor of a small town after discovering she was a Chinese national posing as a Filipina citizen and operating a cyber-scam center.

Whether the current incident involved China or cybercriminal groups is not clear. While Hunt.io did find some Chinese language fragments in the parts of the code, that code belonged to a third-party software library; thus, Hunt.io did not attribute the hack. The company did say, however, that both cybercriminals and nation-state adversaries would find value in the personally identifiable information (PII).

"That kind of migrant-worker PII, plus contract and payment data, is useful for fraud and identity theft, so it has commercial value," Borges says. "It's also a detailed map of a diaspora population, which can interest a state actor."

Not Top-Notch, Not Amateur

The latest insight into attacks on the Philippine government came after Hunt.io researchers discovered an open directory on a server hosted on the Singaporean address space of a Helsinki-based firm UpCloud Ltd., the analysis stated . The open directory contained tools and logs files for the attack, including a rebranded version of the GodPotato privilege escalation library, a PowerShell stager to unpack tools in memory, and the full Impacket Python environment.

Related: Russian Influence Operation Widely Targets Latin America

While Hunt.io considered the incident a confirmed compromise, the lack of runtime telemetry meant that Borges could not answer where the attacker moved the data.

"[W]e still can’t answer ... how they got in, whether the payload ran, and where the data went," he says.

However, the tools and the attacker's process indicated an operator with some strong ability, but who also made some simple mistakes, Borges says.

"The payload engineering is competent, [but] the operational security is poor — they left the staging server and its logs wide open," he says. "[It was] someone who can build the tool properly but was careless keeping their own server quiet. I wouldn't call that top-tier or amateur."

Philippine Worker Data Up in the Air

The impact of the breach may boil down to the identity of the attacker and what they do with the stolen data. While Hunt.io notified the CERT Philippines (CERT-PH) and the Department of Migrant Workers (DMW), the company declined to provide any more details of the national responses to the leak.

Related: Venezuelan Cartel's Malware Honcho Nabbed for ATM Jackpotting

However, Borges did say that, so far, the information has not appeared for sale on the Dark Web .

"We haven't seen the backups surface for sale or in a leak," he says. "We never opened the backups themselves."

Governments in the region need to scan their own networks and lock down their attack surface area, he says. Workers with too many privileges allow attackers with tools such as SeImpersonate to gain more access to assets on the network. Hunt.io also found that the migrant-worker portal exposed a number of risky ports, including SMB on 445 and WinRM on 5985 and 47001.

Rob is an award-winning, veteran technology journalist of more than 30 years, reporting on global cybersecurity issues, the latest offensive and defensive technologies, malware incidents, cyber conflict, and AI's impact on software and cybersecurity.

A former research engineer, Rob has written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. He has received five awards for journalism, including Best Deadline Journalism (Online) in 2003 for his coverage of the Blaster worm. Rob also analyzes data on various trends using Python and R for both his reporting and his clients. Recent reports include analyses of the shortage in cybersecurity workers, annual vulnerability trends, and annual threat reports.

Rob holds degrees from Cornell University in Electrical Engineering and Computer Science (double major).

Want more Dark Reading stories in your Google results?

2026 State of Cybersecurity Report: Bridging the Divide

The Autonomous Endpoint Management Advantage

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

LLM Security Architecture: Building Secure AI Systems from the Ground Up

Resilient Architecture: Designing Systems That Survive Compromise

Prompt Injection 101: What It Is and How to Stay Ahead

The Long Tail Is Now the Front Line: Reducing Frontier-AI & Third-Party App Risk

How to Harness your Security Operations Data for Enterprise Defense

Operation DoppelBrand: Weaponizing Fortune 500 Brands

Chinese APTs Hacking Asian Orgs With High-End Malware

CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks

Deja Vu: Salesforce Customers Hacked Again, Via Gainsight

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Philippine Employment Agency Data Breach Exposes 69GB of Migrant Worker Records A cyberattack on the Philippine Overseas Employment Administration resulted in the exfiltration of approximately 69GB of sensitive data, including migrant worker information, contracts, and financial records. The breach occurred on September 6, 2026, when an unknown threat actor accessed and copied 27 SQL Server backups in under 24 minutes. The attacker utilized tools such as GodPotato and the Impacket network library to facilitate the data transfer. Although the data has not been found for sale, its potential for identity theft and fraud is significant. Hunt.io, which analyzed the breach, noted that the operator left logs open on the internet, revealing their actions. The exact method of initial access remains unclear, and while some code fragments were in Chinese, no attribution to a specific threat actor has been made. This incident follows previous breaches involving Philippine government data, raising concerns about ongoing vulnerabilities. 1 sources 59

Extracted Entities

Philippine Migrant Worker Data Likely Leaked in 69GB Breach

The full story

Extracted Entities

Attack Types (1)

Companies (3)

Countries (2)

CWE Weaknesses (1)

Domains (1)

Industries (1)

MITRE ATT&CK (3)

Tools (4)