Philippine firms face rising cyber threats as 9 million credentials compromised

Philippine organizations faced mounting cybersecurity risks in the third quarter of 2026, with more than 9 million compromised credentials recorded as cybercriminals intensified phishing, ransomware, and data theft attacks.

Government agencies, financial institutions, and consumer services were among the sectors most affected, according to the latest Cyber Threat Landscape Report of Viettel Cyber Security (VCS), which covered cyber threat activity in the Philippines from July to September.

The report recorded 10,913 phishing attacks and 83 data breach incidents that exposed 85.9 million records during the period. Ransomware attacks also increased across transportation, manufacturing, hospitality and tourism, financial services, and healthcare.

“Attackers today don’t need to break in when they can simply log in. With more than 9 million Philippine credentials compromised in a single quarter, a stolen password has become one of the cheapest ways into a company’s network. The real question for business leaders is no longer whether their accounts have been exposed, but whether they would notice when someone else starts using them,” VCS Country Manager Thomas Luu said.

Phishing attacks, credential theft intensify

Phishing attacks in the Philippines rose 43 percent year on year to 10,913 in the third quarter, with the banking, financial services, and insurance sector accounting for 29 percent of recorded incidents.

Government impersonation accounted for 24 percent, while social media-related threats represented 16 percent.

Cybercriminals are also increasingly using artificial intelligence-generated deepfakes to impersonate trusted authorities and make fraudulent schemes more convincing, the report said.

Credential theft remained a major concern, with compromised credentials linked to Philippine users more than doubling from 4.3 million in the third quarter of 2025.

The year-to-date tally reached more than 28.3 million, nearly three times the total recorded throughout 2025.

VCS attributed the growing accessibility of cyberattacks partly to the commercialization of stolen credentials through the Stealer-as-a-Service model, which allows criminals to rent information-stealing tools and trade compromised login details.

These credentials can facilitate account takeovers, business email compromise, and ransomware intrusions.

Meanwhile, ransomware incidents nearly quadrupled year on year, rising from five in the third quarter of 2025 to 19 in the same period this year.

Transportation and logistics recorded the highest number of incidents, followed by manufacturing. Other affected industries included hospitality, financial services, and healthcare.

Data breaches expose millions of records

The report also identified several major incidents involving sensitive personal and organizational information.

Six online lending platforms suffered data breaches involving approximately 32 million records, while an incident affecting the transportation sector exposed 16 million records.

Separate attacks involving public institutions and healthcare facilities compromised identity documents and internal systems, including hospital data covering more than 3.5 million files.

Such incidents expose organizations to risks beyond data theft, including unauthorized system access, financial losses, operational disruptions, and reputational damage.

Firms urged to strengthen cyber defenses

VCS urged Philippine organizations to move beyond reactive cybersecurity measures and adopt more proactive approaches as threats become increasingly sophisticated.

Its recommendations include strengthening account protection, conducting continuous threat monitoring, installing timely software updates, maintaining regular data backups, and improving incident response capabilities.

Organizations were also advised to assess third-party security risks and strengthen employee awareness to reduce potential entry points for cybercriminals.

Luu said businesses must treat cybersecurity as a management priority rather than an issue addressed only after an attack.

“What we often see on the ground is that organizations only discover an attack after the damage is done. Going into 2027, the businesses that stay ahead will be those that treat cybersecurity as a leadership priority reviewed regularly, not an IT problem fixed after an incident. Knowing where you are exposed before attackers do is now a basic business requirement,” he said.

VCS said it continues to monitor emerging attack patterns and provide threat intelligence to help organizations identify vulnerabilities and strengthen their cybersecurity defenses.