69GB of Philippine Migrant Worker Data Leaked in Government Breach
Original title: Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach
An unknown operator exfiltrated 69GB of migrant worker and contract data from the Philippine Overseas Employment Administration to a Singapore staging server.
An unknown threat actor gained access to SQL Server backups at the Philippine Overseas Employment Administration and copied 27 databases containing worker, contract, accreditation, and financial records in under 30 minutes. The attackers used GodPotato, SeImpersonate, and Impacket to move data to a staging server. Hunt.io analyzed the logs and noted the breach was complete even if the data was later removed.
Unconfirmed: It is unclear which threat actor performed the exfiltration and whether the data was sold.
- 27 backup databases copied in 24 minutes
- Data covers case management, contracts, and LandBank records
- Tools include GodPotato and SeImpersonate
- Staging server in Singapore
- Hunt.io analysis of exfiltration logs
Impact: data on migrant workers, contracts, and financial records
- Organizations
- Hunt.io
- Countries
- Philippines
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 058ef0cfb57652bddd698609c655b901 | storm-backdoor-attacks#recipe=similar-items&sourcecontentid=058ef0cfb57652bddd698609c655b901) CISA Warns of 'Ongoing' Brickstorm Backdoor Attacks by Ro |
| md5 | 142a2e80d6a5fef7c9df2e421245edcb | ing-fortune-500-brands#recipe=similar-items&sourcecontentid=142a2e80d6a5fef7c9df2e421245edcb) Operation DoppelBrand: Weaponizing Fortune 500 Brands by |
| md5 | 4056475ddaadba32176031a32b0b2af4 | omers-hacked-gainsight#recipe=similar-items&sourcecontentid=4056475ddaadba32176031a32b0b2af4) Deja Vu: Salesforce Customers Hacked Again, Via Gainsight |
| md5 | 772e2b458963b1a9ec224771cac5b591 | -orgs-high-end-malware#recipe=similar-items&sourcecontentid=772e2b458963b1a9ec224771cac5b591) Chinese APTs Hacking Asian Orgs With High-End Malware by |
From the original article
7 min read at darkreading.com
An unknown operator appears to have exfiltrated SQL Server backups from the Philippine Overseas Employment Administration in under a half hour.
By Robert Lemos · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.