Cybercrime in the Philippines is no longer just growing. It is exploding.
After about 315,000 online credentials were compromised in the first half of 2024 and nearly 3.7 million in the same period last year, the number surged to more than 19.2 million in the first six months of 2026, according to Viettel Cyber Security (VCS). The steep jump suggests cybercriminals are scaling up their operations almost as quickly as Filipinos embrace digital banking, e-commerce and online services.
The latest Cyber Threat Landscape Report paints a picture of an escalating digital arms race. While banks, regulators and government agencies have tightened cyber defenses through tougher rules and broader security programs, hackers are fighting back with artificial intelligence, stolen personal data and increasingly coordinated attacks that target not only corporations but ordinary consumers.
VCS recorded 255 data breach incidents in the first half, exposing roughly 335 million records and 2.6 terabytes of sensitive data. Several high-profile attacks struck financial institutions, public agencies and schools, demonstrating that no sector is immune.
The report comes as the Bangko Sentral ng Pilipinas enforces stronger safeguards under the Anti-Financial Account Scamming Act, while the Department of Information and Communications Technology expands initiatives such as the DICT Trusted Assessment Providers and the Cybersecurity Posture Assessment Laboratory to strengthen cyber resilience across government and critical infrastructure.
Still, VCS warned that compliance alone is no longer enough.
For ordinary Filipinos, the consequences are increasingly personal. A password stolen from one website can unlock multiple online accounts if reused elsewhere. Personal information leaked in one breach can also fuel convincing scam calls, fake job offers, fraudulent delivery notices or phishing messages that appear to come from banks, government agencies or even relatives.
The report logged more than 16,600 phishing attempts nationwide and warned that AI-generated deepfake voices and videos are making scams even harder to detect. Criminals can now impersonate bank employees, government officials or family members with alarming realism to trick victims into revealing one-time passwords or authorizing fraudulent transactions.
The lesson is becoming harder to ignore for households and businesses alike. Verifying an unexpected message or phone call before clicking a link or sharing sensitive information has become as important as locking the front door.
