Skip to content
Leak-site post naming Philippine Ports Authority, captured by ThreatCluster

Philippine Ports Authority

qilin

Ransomware leak-site victim intelligence · EN

Views
10,141
Posted
Sep 5, 2026
Country
PH
Industry
Business Services

Summary

Written by ThreatClusterfrom site fields, victim profile, leak post, screenshot, our reporting

The group qilin claims to have leaked data from the Philippine Ports Authority; the leak page does not specify the amount of data taken. The page identifies the victim as the Philippine Ports Authority and provides basic identifiers, including the domain ppa.com.ph, the sector Business Services, and a company URL (http://www.ppa.com.ph) plus a WikileaksV2 link. The leak post is listed as the publication status.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
http://www.ppa.com.ph

What was taken

Philippine Ports Authority

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Company url
http://www.ppa.com.ph
WikileaksV2
https://wikileaks2.com/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Logo of the Philippine Ports Authority featuring a stylized compass and elements representing water and ships, set against a white background.
onion leak page18 KB

Negotiation

Tox 7C35408411AEEBD53CDBCEBAB167D7B22F1E66614E89DFCB62EE835416F60E1BCD6995152B68
Onion http://pandora42btuwlldza4uthk4bssbtsv47y4t5at5mo4ke3h4nqveobyd.onion