Nearly 69GB of Philippine migrant worker data stolen

An unknown attacker copied nearly 69GB of data from the Philippine Overseas Employment Administration, including 27 SQL Server backups, in a transfer lasting 24 minutes. Hunt[.]io found logs and tools on a staging server in Singapore and said the files covered overseas-employment case management, accreditation, contracts, cashier records and LandBank records.

The company described the breach as confirmed because logs showed the transfer completing, but it has not examined the backups themselves and cannot establish where the data went or how the attacker gained access.

Hunt[.]io said the operator used GodPotato and SeImpersonate privilege-escalation tools, along with the Impacket Python network library. Its head of research, Esteban Borges, said the attacker’s later access to the staging server was unexplained, and the data has not been found advertised for sale or published in a leak. Hunt[.]io found Chinese-language fragments in code but said they belonged to a third-party library and did not attribute the attack to China or any other group. Borges said the records could be useful for fraud and identity theft, while the worker and payment information could also interest state actors.

Hunt[.]io notified CERT Philippines and the Department of Migrant Workers. Its researchers also found that the migrant-worker portal exposed SMB on port 445 and WinRM on ports 5985 and 47001. Borges said the lack of runtime telemetry left key questions unresolved, including how the attacker entered the network and where the stolen data went.