DoST breach compromised workers’ data

The National Privacy Commission (NPC) on Monday confirmed that the data of Department of Science and Technology (DoST) employees had been compromised.

The confirmation came barely a week after the Department of Information and Communications Technology (DICT) said a cyberattack hit the department, affecting around 2 terabytes of data.

“The NPC has launched an investigation in response to a reported personal data breach within the DoST. Initial findings indicate that the breach includes the personal data of approximately 597 data subjects, all of whom are employees of DoST,” the data privacy vanguard said in a statement, adding that they immediately acted through its Complaints and Investigation Division.

The DICT said it coordinated with the DoST to recover the lost data from the system, considered one of the biggest data hacks in terms of scope.

The NPC has undertaken an on-site investigation at the DoST Central Office to determine the nature and extent of the breach, as well as to identify compromised personal data.

“Preliminary assessments reveal that the breach potentially exposed personal information and sensitive personal information, such as names, gender, civil status, and addresses of DoST’s employees.

“Additionally, the data dump uploaded by the threat actor included several resumes of individual applicants to DoST,” the NPC statement said.

Moreover, the NPC disclosed that the NPC-CID is currently engaged in a thorough analysis of the data dump to fully determine the extent of the breach and assess associated risks.

The NPC said they received a breach notification from DoST on 5 April 2024.

“Under NPC Circular 16-03, the DoST must notify the affected data subjects and the NPC within 72 hours upon knowledge of or a reasonable belief that a personal data breach has occurred,” the NPC said.

With this, the NPC advised the public against accessing, downloading, or sharing the uploaded data dump without legitimate purpose or proper authorization, as such actions may constitute unauthorized processing of personal data, which is punishable by law.

Besides the DoST, it was reported earlier that the Philippine Statistics Authority was also breached, and a data leak transpired in the National ID system.