69GB Breach Exposes Philippine Migrant Worker Records

An unknown threat actor exfiltrated nearly 69GB of data from the Philippine Overseas Employment Administration by copying 27 backup databases in over 24 minutes. The stolen data includes case management information, accreditation records, contracts, and financial records from cashier and LandBank systems. The attacker used privilege escalation tools (GodPotato and SeImpersonate) and the Impacket Python library to move the data through a staging server hosted in Singapore. Hunt.io discovered the breach through an open directory containing the attacker’s tools and logs.

Analysis shows the operator possessed technical skill but demonstrated poor operational security by leaving the staging server and its logs publicly accessible. Chinese language fragments appeared in some code, but Hunt.io attributed these to third-party libraries and made no attribution of the attack. The stolen data has not yet surfaced for sale on the Dark Web, though researchers acknowledge it may have moved beyond the staging server. Both cybercriminals and nation-state actors would find value in the personally identifiable information for fraud, identity theft, and as a detailed population map.

This represents another breach of Philippine government systems. Hunt.io notified the Philippine CERT and Department of Migrant Workers. Researchers identified exposed network ports (SMB on 445, WinRM on 5985 and 47001) and noted that workers with excessive privileges can enable attackers using tools like SeImpersonate to gain broader network access.