NPC confirms St. Luke’s data breach notification following unauthorized access to third-party platform

• TechWatch PH

The National Privacy Commission (NPC) has confirmed receiving a personal data breach notification from St. Luke’s Medical Center following an incident involving unauthorized access to a third-party platform supporting the hospital’s mobile application. According to NPC Spokesperson and Deputy Privacy Commissioner Atty. Jose Belarmino II, the Commission received the notification on October 30, 2026, the same day the hospital publicly disclosed the security incident. St. Luke’s said the incident potentially affected personal information belonging to some of its patients and employees. NPC reviewing breach notification Belarmino said the Commission is currently reviewing the notification under its established procedures for handling personal data breach reports. "The Commission is currently reviewing the notification in accordance with its established procedures for handling personal data breach notifications. At this stage, we are unable to disclose further details as the matter undergoes the Commission’s regular evaluation process." The NPC has not disclosed additional information about the incident while its evaluation remains ongoing. What happened to St. Luke’s? In its October 30 advisory, St. Luke’s disclosed that it had recently identified unauthorized access to a platform supporting its mobile application, which is managed by a third-party service provider. The hospital said it immediately implemented containment measures upon discovering the incident and engaged independent cybersecurity experts to investigate. However, the advisory did not specify how many patients or employees were potentially affected or what categories of personal information may have been involved. Hospital operations unaffected Despite the incident, St. Luke’s assured the public that hospital operations remain unaffected. The medical center also said individuals whose personal information may have been involved would be notified directly. St. Luke’s apologized for the concern caused by the incident and reiterated its commitment to protecting the privacy and security of patients and employees.