30 OCT 2026 — An intruder copied 27 database backups whose names match the Philippines' overseas-employment and migrant-worker systems, then left the record of that copy on an open server in Singapore, according to a report published on 28 October by the threat-intelligence firm Hunt.io. By that log, 68.837 GiB moved in less than 24 minutes on 6 September 2026.
The National Privacy Commission (NPC) says it is investigating. Neither the NPC nor the Department of Migrant Workers (DMW) has confirmed that personal data was taken, and what is inside the backups has not been established. Hunt.io says it never examined them.
What the operator left in the open
Hunt.io's platform captured a working folder served without a password from a Linux virtual private server at UpCloud in Singapore, before the operator took it down. It held more than a hundred files. Among them were a renamed build of GodPotato, a public tool for gaining full control of a Windows machine, an eight-line PowerShell script that rebuilds that tool in memory, a complete copy of the Impacket toolkit and the operator's own logs. Over 16 hours and 9 minutes on 6 and 7 September, the access log shows 543 requests, from 76 addresses. Most of that, Hunt.io says, was scanner traffic with no link to the operation.
The file that matters most is a log from rclone, a common copying tool. It records 27 of 27 files transferred, 68.837 GiB in all, with an elapsed time of 23 minutes 46.3 seconds. Its last entry, at 01:26:50 on 6 September, is a file called POEA_EServices.bak. Other names in the list include POEA_HelpDesk, OFW, OfwDB, BMonline and OWMSDB. The log does not say which machine the files came from or where they were sent.
How Hunt.io ties it to the agency
Hunt.io makes the agency connection with two kinds of evidence, and it is explicit about the limits of both. The first is the filenames. POEA is the Philippine Overseas Employment Administration, which Republic Act No. 11641, approved on 30 December 2021, merged into the new DMW. In Hunt.io's reading, three BM-prefixed names correspond to the Balik-Manggagawa Online Processing System and OWMSDB to the OFW Welfare Monitoring System; others only hint at a system through their names. Hunt.io calls that "a filename-based contextual assessment", not a confirmed identification of the organisation.
The second is certificates. Two addresses that downloaded the operator's files on the evening of 6 September present a valid GlobalSign wildcard certificate for the agency's own web domain, issued to POEA. Hunt.io reads them as the agency's portal hosts. Hunt.io is equally plain about the limit. "The log establishes delivery and nothing further." Nothing in the capture shows whether anything ran on those machines afterwards.
The log disagrees with itself
The transfer figures do not reconcile. 68.837 GiB is 70,489 MiB. Spread over 1,426.3 seconds, that averages about 49.4 MiB a second, or roughly 415 megabits a second. The log's summary line shows 20.238 MiB a second. At that speed the same copy would have taken about 58 minutes, more than twice the time recorded.
Hunt.io reaches the same 49.4 figure and accounts for the gap in the tool's own terms. Rclone's summary speed, it says, "is a rolling average at completion, not total bytes divided by elapsed time", so it reports both numbers as logged.
The order of events matters more than either speed figure. The copy was done roughly 20 hours before anyone pulled the first payload, at 21:41:33 that day. Hunt.io's conclusion is that "the payload was not the mechanism of the theft". The operator, it says, already had enough access at the moment of the copy.
A public tool with a new name
GodPotato needs no Windows vulnerability. It lifts a service account to full SYSTEM control. The operator renamed the namespace, the pipe and the assembly details but left the source file names and some internal fields alone, which Hunt.io describes as a fingerprint of a lightly edited public tool. One build was compiled six minutes and 43 seconds before it was retrieved. Hunt.io checked the 69 Impacket scripts for added code and found none.
For defenders the point is narrow. A Windows service account holding the SeImpersonate privilege sits, in Hunt.io's words, "one reachable handle from SYSTEM on a default Windows host".
What the report does not establish
The recovered material shows no initial access route, no command-and-control channel, and no confirmed execution of any payload. There is no organisational identifier, victim hostname, or credential. The destination of the 68.837 GiB is unknown. Hunt.io does not attribute the activity to any tracked group and says the capture is not enough to do so. Before publishing, it informed the relevant national CERT.
The report cites a Philippine Statistics Authority estimate for 2023 of 2.16 million workers overseas. Hunt.io describes that as the population the systems serve and "not a count of the records in these backups".
On 7 September the Department of Information and Communications Technology said its emergency response team had worked with DMW after detecting unauthorised access to the agency's website, NewsBytes.PH reported at the time. Neither Hunt.io nor the NPC connects that incident to this one.
The privacy regulator responds
The NPC told Rappler it is "aware of the matter and is conducting an investigation to assess the facts and circumstances of the incident and determine whether any violations of the Data Privacy Act of 2012 have occurred", in a statement reported on 29 October. The commission added that it is coordinating with DMW. NewsBytes.PH attributed the same statement to NPC spokesperson Roren Chin.
We found no statement on either agency's website as of 30 October. Rappler said it had asked DMW and the national emergency response team for comment. In the meantime, Hunt.io's researchers told Rappler that people should "be wary of scams or messages that reference your OFW or employment records, and trust official notices over anyone else who reaches out."
View author profile → · Editorial policy
