The National Privacy Commission (NPC), the Philippine data privacy regulator, said on 6 November 2026 that it knows of reports of alleged data leaks at several government agencies. Spokesperson Jose Belarmino II said none of the agencies had filed a breach notice as of that day. Rappler reported that Deep Web Konek and BetterGov.PH named the systems said to be hit.
The leaks are alleged, not confirmed. The NPC said it will contact the agencies, learn what happened, and decide whether personal data were exposed. Checking a claim means asking whether the files are real, whether they hold personal data, whose data it is, and how it left the system. The sources give no detail on what was taken or how many people are affected. Rappler noted that the reports coincided with the Million Mask March, a protest day commonly preceded by leaks. Neither the NPC nor Rappler says the two are linked.
Under NPC Circular No. 16-03, personal information controllers must tell the NPC and affected people within 72 hours of knowing of, or reasonably believing in, a breach that requires notice. The NPC says a leak report alone does not establish a breach. Leaders can ask who decides when reasonable belief is reached, and how fast staff can tell a real incident from a posted claim.