An unknown threat actor exfiltrated nearly 69GB of sensitive information from the Philippine Overseas Employment Administration, compromising records related to migrant workers, contracts, and financial data, as first
The breach involved the theft of 27 backup databases during a 24-minute window. According to an Oct. 28 analysis by threat intelligence firm Hunt.io, the attackers utilized a Singaporean staging server to facilitate the transfer. The perpetrators employed sophisticated privilege escalation tools, including GodPotato and SeImpersonate, alongside the Impacket network library to move the data. While the investigation confirmed the data was copied out of the agency’s control, the final destination of the stolen files remains unknown.
The compromised information includes personally identifiable information, which experts note is highly valuable for identity theft, fraud, and potential state-sponsored surveillance. Although Hunt.io identified Chinese language fragments in third-party code, they have not attributed the attack to a specific nation-state or criminal group. The incident highlights significant security lapses, as the attackers left their staging server and logs exposed. Hunt.io has notified the Department of Migrant Workers and the Computer Emergency Response Team Philippines, though the stolen data has not yet appeared for sale on the dark web.
