The National Privacy Commission (NPC) has concluded its investigation into the reported GCash data leak, finding no evidence of a personal data breach within the mobile wallet’s systems.
The inquiry began after reports surfaced of an alleged dataset being offered on a deep web forum. On October 27, 2025, the NPC ordered G-Xchange, Inc., the operator of GCash, to submit technical documentation, preserve system logs, and participate in a clarificatory conference and live technical demonstration before the agency’s Complaints and Investigation Division (NPC-CID).
Following GCash’s full cooperation, the NPC said, “Independent validation by the NPC-CID confirmed that the dataset circulating online was inconsistent with GCash’s verified data structures. Several of the listed accounts were found to be invalid or inactive, and no indicators of unauthorized access, infiltration, or data exfiltration were detected within GCash’s monitored environments.”
The NPC added that results from a live technical demonstration on October 29 “indicate that no unauthorized access attempts were made to GCash’s critical databases, including the database storing eKYC data.” The review covered activity from January 1 to October 29, 2025, and “returned zero events,” confirming that only approved internal IP addresses accessed the system.
“This strongly indicates that no breaches, unauthorized access, infiltration, or exfiltration attempts occurred,” the NPC said, emphasizing its ongoing commitment to monitor data protection threats and uphold the Data Privacy Act of 2012.
The commission also warned that unauthorized access, sale, or distribution of personal data violates the law and urged the public to remain vigilant and report suspected data breaches.
The finding reassures users and investors of GCash’s data integrity and operational security, underscoring the platform’s compliance with privacy regulations—a key factor in maintaining public trust and its position in the competitive fintech market.
