Philippine military investigates claimed hack of air force personnel records

The Armed Forces of the Philippines said on 10 November that it was investigating claims that a hacker had taken files from a Philippine Air Force personnel system, but that it had not yet established whether any military data had actually been compromised. AFP spokesperson Colonel Francel Margareth Padilla described the reports as unconfirmed speculation at a press briefing at Camp Aguinaldo in Quezon City.

The investigation follows a post by Deep Web Konek, a Philippine cybersecurity advocacy and threat intelligence group, which said a hacker had obtained files from the air force's Human Resource Management Information System. Citing a listing on a dark web forum, the group said the material included confidential and restricted command orders, logistics and promotion records, information on military camps and bases, and the full names and identification numbers of personnel.

These are claims made by the group and by the anonymous poster, who also said the files had been put up for download on the forum. The authenticity of the files and of the reported breach had not been independently verified, the Inquirer reported. According to the Daily Tribune, the alleged leaks were first reported online on 5 November.

Padilla said cybersecurity units across the military, from the AFP Cyber Command down to the cyber units of the individual services, were checking whether the reports were credible. She said the military does not normally respond directly to claims made online but verifies them through its own internal investigation, and that a proper forensic investigation may be needed to establish whether the reports are true.

Air force spokesperson Colonel Alvin Jay Capinguian said the service had checked its own systems and passed the matter to AFP Cyber Command. He said the air force's 950th Cyber Wing was working with the command to verify the allegations.

Asked whether exposed personnel records could affect military operations, Padilla said the impact would depend on the nature and extent of the information involved. She said military networks face thousands of attempted cyberattacks on a normal day, that the priority is to stop them from getting through, and that no computer system can be regarded as completely impenetrable. She gave no timeline for the investigation and said updates would follow once technical teams submit their findings.

The National Privacy Commission has said it was aware of the reported incidents, but it had not received personal data breach notifications from the government agencies concerned, the Daily Tribune reported.

The air force case is one of a wider set of alleged leaks. Deep Web Konek has flagged breach and exposure incidents at 23 Philippine institutions, including national government agencies, law enforcement bodies, military systems and schools, based on underground disclosures it monitored from 5 to 7 November, the Philippine Star reported. The group said the incidents involved millions of personal, corporate and administrative records as well as one website defacement.

Among the cases on that list, the group said a hacking outfit calling itself DeathNote Hackers had accessed about 12,979 PDF files, roughly 10 gigabytes, from the Office of the Vice President. It also listed utilities and private firms. The Philippine Star said the entities named were still verifying the extent of the alleged breaches.

None of the reports linked the alleged air force intrusion to a foreign government, and the AFP did not name any suspect. For now the military's position is that the breach is unconfirmed, and the central questions of whether the files are genuine and how much was taken will depend on the outcome of the cyber units' review.