Philippine Health Insurance Corp., or PhilHealth, members affected by the ransomware data breach can sue if it is determined that the agency had been negligent in securing its database.

This course of action was proposed by the National Privacy Commission on Tuesday.

"Individuals affected may file a complaint with NPC and, if proven, they can claim damages. However, we cannot determine as of now how much, and usually it will be case to case," the NPC said. PhilHealth emphasized on Monday that it is ready to face any inquiry to be conducted by the NPC, the National Bureau of Investigation and the Philippine National Police on the hacking incident.

The NPC had issued a "critical warning regarding the leaked personal data from the PhilHealth (system)."

"It has come to our attention that the personal data exfiltrated from PhilHealth is being shared illicitly," the NPC said, referring to reports that the personal data of members had been uploaded to the so-called dark web.

The dark web is the underbelly of the internet where hackers and those who deal in stolen data transact business. Stolen data can result in identity and monetary theft, among other crimes.

The NPC warned that those who would download, share or process the stolen PhilHealth data would be prosecuted.

Under Section 25 of the Data Privacy Act of 2012, those found guilty of unauthorized processing of personal information face imprisonment of one to three years, and fines of P500,000 up to P4 million.

"Sharing such leaked data exposes affected individuals to a range of risks, including identity theft, fraud, extortion, blackmail, and other malicious activities. We urge you, as responsible citizens, to refrain from resharing this data and to promptly report its presence to the relevant authorities, including the NPC and the law enforcement agencies," the NPC said.

Moreover, the NPC called on personal information controllers and processors to strengthen their data protection measures.

"Compliance with the DPA and other relevant laws and regulations is not just essential, it is a collective responsibility to protect the rights and privacy of every Filipino," the NPC said.

Earlier, Information and Communications Technology Undersecretary Jeffrey Dy said a "staggering" 730 gigabytes of information, or roughly equivalent to over one million PhilHealth membership registration forms, had been stolen.