Philstar NPC Confirms Data Breach Affecting 10 Government Agencies
Article Content
- •NPC confirmed data breaches in 10 government agencies.
- •Agencies must comply with the Data Privacy Act regarding breach notifications.
- •Public warned to be cautious of phishing and identity theft following breaches.
The National Privacy Commission (NPC) has confirmed data breach notifications from at least 10 government agencies, including the Bureau of Internal Revenue and the Department of Information and Communications Technology. The breaches were reported on November 11, 2026, following a series of cybersecurity incidents. NPC Deputy Privacy Commissioner Jose Belarmino II stated that while breach notifications are mandatory, agencies remain liable for their data protection responsibilities. The NPC is evaluating the notifications and will recommend regulatory actions based on its findings. Agencies are reminded that outsourcing IT services does not exempt them from legal obligations under the Data Privacy Act. The NPC also warned the public to be vigilant against potential phishing and identity theft attempts that may arise from these breaches. A previous report indicated that as many as 23 local institutions could be affected by similar incidents.
Ask AI about this cluster
Answers cite the sources they use
More articles in this cluster (7)
Following this threat?
Track Bureau Of Internal Revenue in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Common questions
Which agencies are affected?
What should affected agencies do?
How can the public protect themselves?
Continue Reading
Critical RCE Vulnerability in Confection WordPress Plugin (CVE-2026-115252) A critical vulnerability, CVE-2026-115252, has been identified in the Confection WordPress Cable plugin, affecting versions 0.4.0 to 0.4.7. This flaw allows unauthenticated attackers to execute arbitrary PHP code on the server by writing unmodified settings into a PHP file without proper checks. The vulnerability has… 
Critical Code Injection Vulnerability in Staggs Plugin for WordPress A critical code injection vulnerability, CVE-2026-78287, has been identified in the Staggs plugin for WordPress, affecting versions up to 3.3.0. This flaw allows unauthenticated attackers to execute arbitrary code remotely, posing severe risks to affected sites. The vulnerability stems from improper control over code…