Initial findings from the Securities and Exchange Commission (SEC) show that its data security incident did not affect any company records or leak any passwords, according to a statement on 9 November.

According to the SEC, the incident may have exposed individual profile information.

Verification of the origin, scope and validity of the affected records is still underway, and the regulator said no one modified or altered any data.

The statement follows reports that the SEC had begun notifying affected users of the leak, which it detected on 6 November.

The SEC formally notified the National Privacy Commission on 9 November.

System-Wide Audit Underway

The SEC is now conducting a comprehensive investigation and system-wide audit across all its digital platforms and databases.

After discovering the incident, it ran security scans, digital forensics and log analyses to check whether any internal system showed signs of unauthorised access.

It also reinforced access controls, updated authentication credentials and added monitoring rules across its digital infrastructure.

The SEC said its internal database infrastructure and system integrity remain intact.

Steps for SEC Platform Users

The SEC advised users to change the password of any online account that shares a password with their SEC account.

It also urged them not to share login details, one-time passwords or email verification links with anyone.

Users should run security scans on their devices, turn on two-factor authentication where available and monitor their accounts for unusual activity.

The SEC reminded the public that it will never ask for passwords or security PINs.

Users with questions can email dpo@sec.gov.ph or call (02) 8818-5235.

BIR Investigates Separate Claims

Separately, the Bureau of Internal Revenue (BIR) said in a 9 November advisory that it is addressing claims of cybersecurity breaches with the Cybercrime Investigation and Coordinating Center and the Department of Information and Communications Technology’s emergency response team.

The BIR said it had implemented immediate measures to protect its systems and taxpayer data, and urged the public to transact only through its official channels.

It did not say what data, if any, may have been affected.

Featured image: Edited by Fintech News Philippines based on an image by the Securities and Exchange Commision via its website.