The Philippine Health Insurance Corporation on Sunday called on the public to take precautionary measures such as changing their online accounts' passwords following the publication of its members' personal data on the dark web.

PhilHealth president and chief executive officer Emmanuel Ledesma Jr. warned that members of the state-run health insurer may be vulnerable to fraudulent schemes perpetrated by hackers.

"Using the stolen data, the hackers will likely target members through calls, emails, or text messages," Ledesma said in a statement.

He added: "Let us then heed the advice of authorities to refrain from clicking doubtful links or providing passwords or OTPs. It is best to ignore suspicious calls, and to delete text or emails instead from unknown and suspicious senders."

He issued the warning a week after he assured that the hackers stole no members' data during the cyber-attack on its system on 22 September.

Ledesma, along with other PhilHealth officials on a 2 October press briefing, stressed that the personal data of its members are "intact."

The state-run health insurer, however, admitted later on that hackers may have accessed the local files of workstations affected by the attack.

PhilHealth "strongly" advised its members to take precautionary measures to avoid being victimized by unscrupulous individuals.

Aside from changing the passwords of online accounts, the state-run health insurer also encouraged its members to enable their multi-factor authentication, a feature that requires the user to provide two or more verification factors to access their account.

'Open to any investigation'

It also urged its members to "monitor suspicious activities in their online accounts, not opening and clicking suspicious emails and links, and not answering suspicious calls and text messages."

The state health insurer also appealed to the public to "refrain from further circulating leaked data as it has dire consequences under the law."

"Recently, authorities have said the hackers may face up to 20 years of imprisonment, while any individual or organization found to download, process or share such exfiltrated data will likewise be held accountable for unauthorized processing of personal information and may face criminal charges," it said.

For his part, Ledesma said PhilHealth is open to any investigation regarding the cyberattack, which they previously attributed to the outdated system protection software.

"As responsible for the information of our members, we are ready to cooperate in investigations to further improve our cybersecurity system," he said.

"The public can be assured that this incident would have a positive impact on our services to our members," he added.

PhilHealth said all its public-facing applications were back online, including the website, Member Portal, eClaims for electronic submission of hospital claims, and EPRS for employer remittances.

Meanwhile, it noted that application servers catering to frontline services are also being readied to return to normal operations.