The files, totalling approximately 68GB, carried names associated with the former Philippine Overseas Employment Administration (POEA), overseas employment services and migrant worker records.

However, investigators have not established whether the files contained personal information or whether anyone accessed it.

Cybersecurity firm Hunt.io said it discovered evidence of the suspected theft on a publicly accessible server hosted in Singapore.

The server contained transfer logs showing that attackers copied 27 Microsoft SQL Server database backups on September 6, 2026, in just 23 minutes and 46 seconds.

The researchers published their findings on October 28.

The filenames referenced POEA online services, overseas Filipino worker databases, employment contracts, and the Balik-Manggagawa system, which returning overseas workers use.

Hunt.io also identified technical links to servers associated with the DMW’s government domain.

The researchers did not examine the contents of the database backups and could not confirm what information they held.

They also could not establish how the attacker initially gained access or where the copied files were ultimately stored.

NPC spokesperson Roren Chin said the commission was examining the incident to determine whether the country’s Data Privacy Act of 2012 had been violated.

The regulator is working with the DMW to address potential privacy concerns and protect individuals whose information may have been affected.

The DMW has not publicly confirmed the full extent of the suspected breach.

Hunt.io said it had notified the relevant Philippine cybersecurity response authorities before publishing its findings.

The case raises concerns for overseas Filipino workers who have used government employment and documentation services, although there is no confirmation that their personal records were exposed.

The privacy regulator has not announced how many individuals, if any, may have been affected.