Cyber threats across the Philippines have intensified significantly this year, with more than 9 million user credentials compromised in the third quarter alone, according to the latest Cyber Threat Landscape Report from Viettel Cyber Security (VCS). The figure marks more than double the 4.3 million recorded in the same period last year, bringing the year-to-date total to over 28.3 million—nearly three times the full-year count for 2025.
Government bodies, financial institutions, and consumer services bore the brunt of the breaches. Between July and September, the report documented 10,913 phishing attacks and 83 data breaches that together exposed 85.9 million records nationwide. Phishing attempts jumped 43% compared to Q3 2025, with the banking and financial sector making up 29% of all attacks, followed by government impersonation at 24%. Cybercriminals are also turning to AI-generated deepfakes to impersonate trusted people and authorities, making scams harder to spot.
Ransomware incidents surged as well, nearly quadrupling from five cases in Q3 last year to 19 in the most recent quarter. Transportation and logistics saw the highest number of attacks, followed by manufacturing, hospitality, financial services, and healthcare. Major breaches included six online lending platforms where roughly 32 million records were exposed, and a transportation sector incident that compromised 16 million records. Attacks on public agencies and medical facilities also leaked identity documents and sensitive health data covering more than 3.5 million files.
“The reality today is that attackers don’t always need to hack their way in—they simply log in,” said Thomas Luu, VCS Country Manager. “Stolen passwords have become one of the easiest and cheapest ways to access company networks. The question is no longer whether your accounts have been exposed, but whether you would notice if someone else was using them.”
The growing trade in stolen credentials and services like Stealer-as-a-Service has lowered barriers for criminals, letting them rent tools and buy access to launch account takeovers, business email compromise, and ransomware strikes more easily than ever. These threats carry real consequences, from financial loss and operational shutdowns to leaked personal information and lasting public trust issues.
As the country heads into 2027, VCS is urging organizations to move beyond waiting for an incident before acting. Key steps include stronger login protections, constant threat monitoring, regular software updates, secure backups, and better employee awareness. Businesses are also reminded to check the security practices of partners and suppliers. Luu emphasized that cybersecurity must be treated as a top leadership concern rather than just an IT issue, noting that knowing where vulnerabilities lie before attackers find them is now an essential part of doing business.
