Overview
Researchers at Hunt.io report that an unknown operator appears to have copied 27 Microsoft SQL Server backup files totaling 68.837 GiB in under 24 minutes on September 6, 2026. The data is believed to belong to the Philippines' Department of Migrant Workers (DMW), which absorbed the former Philippine Overseas Employment Administration (POEA). The Philippines' National Privacy Commission (NPC) is investigating and coordinating with the DMW.
Dark Reading headlined the story as "likely leaked". Other outlets describe it as a suspected theft, because the backups themselves have not been examined.
What the Evidence Shows
- Hunt.io's October 28 report is based on transfer logs left on an exposed server in Singapore.
- Two addresses pulling files from the open directory presented a valid GlobalSign wildcard certificate for
dmw.gov.ph, which is how the server was tied to the agency. - File names point to overseas-employment case management: accreditation, contracts, and cashier and LandBank records. Some referenced the Balik-Manggagawa system.
- The server also held malicious tooling.
What Is Not Known
- Hunt.io did not inspect the backup contents.
- It has not established how the operator gained access, where the files went afterward, or whether the tools on the server were run against government systems.
- The data had not appeared for sale on dark web markets at the time of reporting.
Why It Matters
Overseas-employment records typically combine identity details, contracts, employer information and payment records. If real, exposure would put migrant workers at risk of identity fraud, targeted phishing and recruitment scams, and could hand criminals material to impersonate the agency.
Recommendations
For affected individuals (Philippine overseas workers):
- Treat unsolicited messages that reference your contract, employer or agency fees with suspicion.
- Verify requests for payment or documents directly through official DMW channels.
- Monitor bank and LandBank-linked accounts for unusual activity.
For organizations:
- Keep database backups off internet-reachable hosts and encrypt them at rest.
- Alert on large, rapid outbound transfers of backup files.
- Audit certificate transparency and exposed-directory scans for your own domains, since attackers' staging servers can reveal your certificates.