Philippines Investigates Suspected Theft of 69 GiB Overseas Employment Database Backups

Cybersecurity firm Hunt.io recently reported that database backups associated with Philippine government overseas employment systems were suspected to have been stolen. Researchers identified transfer logs for 27 Microsoft SQL Server database backups on an exposed, unauthenticated cloud server in Singapore used by attackers. The records indicate approximately 69 GiB of data was copied in under 24 minutes on September 6. Backup file names suggest the data originated from systems managed by the Philippine Overseas Employment Administration (POEA), involving migrant workers, employment contracts, accreditations, and repatriations. Researchers also found privilege escalation tools such as GodPotato, PowerShell scripts, and Impacket on the server, with IP addresses linked to Department of Migrant Workers (DMW) portals having downloaded payloads. News reports indicate the National Privacy Commission (NPC) has launched an investigation alongside the DMW to examine the potential breach and compliance with data privacy regulations.

Key takeaways

• Hunt.io discovered logs on an exposed attacker server showing 27 database backups totaling roughly 69 GiB were copied within 24 minutes on September 6.
• The exfiltrated data appears to involve POEA records spanning migrant workers, employment contracts, accreditations, and repatriation operations.
• The threat actor's infrastructure hosted tools like GodPotato and PowerShell scripts, with IPs tied to Philippine DMW portals downloading tools.
• The Philippine National Privacy Commission (NPC) and the Department of Migrant Workers have initiated an investigation into the suspected breach.