Security Experts:

Connect with us

Hi, what are you looking for?


Incident Response

55 Million Exposed After Hack of Philippine Election Site

A cyber-attack on the website of the Philippines Commission on Elections (Comelec) has resulted in personally identifiable information (PII) of roughly 55 million people being leaked online.

A cyber-attack on the website of the Philippines Commission on Elections (Comelec) has resulted in personally identifiable information (PII) of roughly 55 million people being leaked online.

While there are no exact details on the number of affected people, it appears that hackers managed to grab the entire voter database, which includes information on the 54.36 million registered voters for the 2016 elections in the Philippines. Information on voters abroad also leaked, along with other sensitive data.

Should the data in this leak prove genuine, it would make the breach one of the largest so far this year, on par with the recent hack of a database apparently containing details of almost 50 million Turkish citizens, which determined Turkey’s authorities to launch a probe into the incident. It would also be the largest breach after the Office of Personnel Management attack last year.

As the Philippines prepares for the upcoming national elections on May 9, Comelec has been pushed for increased transparency, and the security of their Automated Voting System (AVS) has been questioned. The breach also reveals that the commission doesn’t employ all of the necessary security measures to keep its systems safe.

The data leak incident began on Sunday, March 27, when Anonymous Philippines hacked and defaced the Comelec website. The hacking group was reportedly looking to encourage the commission to implement the security features of vote-counting machines (VCMs), also known as precinct count optical scan (PCOS) machines.

Soon after, a second group of hackers, which call themselves LulzSec Pilipinas, said that they too breached the Commission’s systems, and that they managed to grab the entire database. The group posted links to index of files that could be downloaded, including a massive comweb.sql.qz archive, which Anonymous Philippines was able to access as well.

The archive was found to include information on candidates, parties, election years and the type of polls (such as national and local elections). According to Rappler, the file contains 75.3 million rows of records about people, including names, birth dates, residential address, birthplace, and Voter’s Identification Numbers (VIN), along with records of registered overseas Filipino voters (OFV).

Real time ballot count included in the leak

According to TrendMicro researchers, who had a look at the archive, the data dump contains 1.3 million OFV records, including passport numbers and expiry dates, all of which was kept in plain text. The researchers also discovered 15.8 million records of fingerprints, along with a list of people running for office since the 2010 elections.

The database also included files with all candidates running on the election with the filename VOTESOBTAINED, which should reflect the number of votes each of them received, but which were set to null. Real time ballot count during the actual elections was also displayed on the site, though Comelec spokesperson James Jimenez suggested this function would be available on a different, more secure website.

Jimenez tried to downplay the incident, suggesting that no actual data was accessed in the breach and that the National Bureau of Investigation was contacted to look into the leaked data. He also suggested that the hackers only managed to grab “a list of names and addresses” and that they can’t make much use of the data.

While the data breach might not have an influence on the impending elections, the fact that voter information leaked might eventually impact millions. Identity theft, phishing, scams, and other nefarious activities might register a fast increase after the leak.

Hacktivists looking to embarrass organizations

The incident, however, might have nothing to do with cybercriminals’ pursue for financial gains, but could be merely the doing of organized hacktivists, Nathan Wenzler, Executive Director of Security at Thycotic, tells SecurityWeek. The rise of hacktivists, he says, is the result of organized hacker groups forming corporations to steal data for financial gain, a growing trend over the past several years.

“Groups like Anonymous, LulzSec, and The Lizard Squad are fairly well known in the security community, over the last couple of years more and more data breaches are being committed by these groups and the resulting data lost is not used for financial gain, but rather to embarrass organizations who fail to properly protect their data and shame them into improving their security postures. Additionally, these data breaches can be used to make political statements or other social commentary against those who are deemed to be “bad” by the hacktivist groups,” Wenzler said.

“And, as we’re seeing with this Comelec breach, that’s precisely what’s happening. Philippine factions of Anonymous and LulzSec are not selling the stolen data on the black market for financial gain, but have made it public to shame the various agencies which should be protecting that data into doing so,” he added.

However, the breach also opens up the potential for other nefarious groups and criminal organizations to take advantage of the leaked data and use it against the individuals who have information in those databases. According to Wenzler, this is where the hacktivism effort becomes an issue.

“While the Comelec absolutely has a responsibility to protect constituent data, and should be held accountable for this breach, the potential threat caused by the hacktivist groups in publishing this data publicly may cause even greater harm in the long run.”

“The fallout from this breach will be years in the making, but hopefully all parties involved will be taking immediate steps to minimize the damage to the
citizens affected by this loss,” Wenzler concluded.

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content

Data Breaches

LastPass DevOp engineer's home computer hacked and implanted with keylogging malware as part of a sustained cyberattack that exfiltrated corporate data from the cloud...

Application Security

GitHub this week announced the revocation of three certificates used for the GitHub Desktop and Atom applications.

Data Breaches

GoTo said an unidentified threat actor stole encrypted backups and an encryption key for a portion of that data during a 2022 breach.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...

Incident Response

Cygnvs emerges from stealth mode with an incident response platform and $55 million in Series A funding.

Application Security

Password management firm LastPass says the hackers behind an August data breach stole a massive stash of customer data, including password vault data that...

Incident Response

Implementation of security automation can be overwhelming, and has remained a barrier to adoption

Data Breaches

T-Mobile disclosed another massive data breach affecting approximately 37 million customer accounts.