NTC says files in alleged EDGE breach may contain personal data

• Photo courtesy of NTC

The National Telecommunications Commission (NTC) said files allegedly disclosed from its EDGE System may contain personal information linked to regulatory applications and supporting documents submitted to the agency.

In a public advisory dated July 16, the NTC said it became aware on July 14 of an online post alleging the unauthorized disclosure of files purportedly associated with the NTC-EDGE System.

“Based on the Commission’s preliminary examination, the allegedly disclosed files may contain various categories of personal information associated with regulatory applications and supporting documents submitted to the Commission,” the NTC said.

The agency stressed that the exact number of affected individuals and the full extent of the information involved have yet to be confirmed.

The NTC said it immediately activated its incident response protocols and began coordinating with the Cybercrime Investigation and Coordinating Center (CICC), the third-party service provider administering the EDGE System, and other concerned offices.

A technical investigation and forensic assessment are ongoing to determine the authenticity, scope, and extent of the alleged data breach.

As a precaution, the commission advised individuals who may have transacted through the NTC-EDGE System to remain vigilant against phishing emails, fraudulent text messages, suspicious phone calls, and social engineering attempts.

The NTC also warned the public not to disclose passwords, one-time passwords, personal identification numbers, or other confidential credentials in response to unsolicited messages or calls.

Individuals were advised to monitor their financial and online accounts for suspicious or unauthorized activities and immediately report possible identity theft, fraud, or misuse of personal information to the proper authorities and financial institutions.

The commission said it is conducting further forensic analysis, validating the allegedly compromised data, coordinating with relevant government agencies, and strengthening its existing security controls.

“The NTC recognizes the importance of protecting the personal data entrusted to it and remains committed to transparency and compliance with the Data Privacy Act of 2012 and applicable issuances of the National Privacy Commission,” it said.

On July 14,  cybersecurity monitoring group Deep Web Konek flagged a claim by a threat actor identified as “DNH,” who is allegedly associated with the DeathNote Hackers group. The threat actor claimed to have obtained around 126 gigabytes of data, comprising approximately 200,000 files, from the NTC.

Deep Web Konek said the alleged dataset included PDF and Microsoft Word documents, SQL database files, JSON files, images, and executable files. The files were also claimed to contain names, email addresses, contact information, internal memoranda, account credentials, identification-related records, images, and other internal documents.

READ:

Deep Web Konek flags alleged 126GB NTC data breach