Short answer
Security firm Hunt.io reported on 28 October 2026 that logs on an exposed server show 27 database backups tied to Philippine overseas worker systems, 68.8 GiB in total, were copied on 6 September. The National Privacy Commission is investigating with the Department of Migrant Workers. The contents have not been examined or confirmed.
If you think your details were included, start with our checklist on what to do after a data breach.
Key facts
| Organization | Department of Migrant Workers (DMW) |
|---|---|
| Incident type | Data breach |
| Status | Under investigation |
| Sector | Government and overseas employment |
| Country | Philippines |
| Detected | 2026-09-06 |
| Disclosed | 2026-10-28 |
| People or records affected | Unknown. Researchers have not examined the contents and no count of affected workers has been given. |
What data was exposed
- 27 SQL Server database backups, 68.8 GiB, with filenames referencing POEA, overseas Filipino worker databases, employment contracts and the Balik-Manggagawa system
- Whether personal data is inside the backups has not been established
What researchers found
On 28 October 2026, cybersecurity firm Hunt.io published findings about an exposed directory on a Singapore-hosted server with no password on its web service. The directory held transfer and access logs, malicious tools and scripts, and records showing that an operator copied 27 Microsoft SQL Server backup files totalling 68.837 GiB on 6 September 2026. The copying took 23 minutes and 46 seconds, according to Newsbytes.PH.
Filenames referred to the Philippine Overseas Employment Administration (POEA), whose functions now sit with the Department of Migrant Workers, and to overseas Filipino worker systems, employment contracts and the Balik-Manggagawa system used by returning workers, per Gulf News. Hunt.io traced later file retrievals to two servers tied to DMW domains.
Official response
National Privacy Commission spokesperson Roren Chin said the NPC is investigating and coordinating with the DMW to find out whether the Data Privacy Act of 2012 was violated. Hunt.io said it told the relevant national computer emergency response team before publishing. The DMW had not publicly confirmed the full extent of the suspected breach, and neither report carried a statement from the Department of Information and Communications Technology.
What is not known
This is a case where the headline number says little about people. Nobody has said whether the backups contain personal data, whose, or how many records. Hunt.io did not check the contents. It also could not say how the operator got in, whether the tools it found were run, or where the files went afterward. Hunt.io cautioned that the 543 requests from 76 IP addresses seen on the exposed server do not by themselves show involvement.
We therefore list the exposed data as filenames, not as a confirmed set of worker records. If the backups do hold contract and registration data, workers and their families would be natural targets for fee scams.
Why OFWs should be careful
Fake agents already charge workers for paperwork that is free or cheap. A scammer holding real contract details could sound much more convincing. Our guide to job scams explains how fake placement fees work, and phishing messages shows how to spot fake government links. If someone pressures you to pay quickly, see urgent payment scams. For general steps, read what to do after a data breach.
Next steps to watch
An NPC finding, a DMW statement on what the backups hold, and any notice to affected workers. We will update this page. More cases are on our breaches page.
Scams to watch for after this breach
Criminals use breach news as cover. Expect messages that mention the incident, quote real details, or offer help.
- Fake recruiters or 'DMW staff' contacting overseas Filipino workers by Messenger, Viber or WhatsApp and asking for fees for contract verification, e-Registration or Balik-Manggagawa processing.
- Job offer scams that quote a worker's real employer or contract details to look credible.
- Phishing links pretending to be DMW online services asking you to log in again.
- Calls to families of OFWs claiming the worker is in trouble abroad and demanding urgent payment.
What to do if you are affected
- 01Do not pay anyone who contacts you about DMW processing, contract verification or clearance. Check the DMW's official website or hotline before sending money.
- 02Do not click links in messages that claim to be from DMW or POEA. Type the official address yourself.
- 03Change the password on any DMW or OFW online account, and on any other site where you used the same password.
- 04File a privacy complaint with the National Privacy Commission (privacy.gov.ph) if you believe your data was misused.
- 05If you lost money to a scam, report it to the Cybercrime Investigation and Coordinating Center hotline 1326 or the PNP Anti-Cybercrime Group, and tell your bank or e-wallet at once.
Frequently asked questions
Has the DMW confirmed the data theft?
No. According to the reports we reviewed, the DMW has not publicly confirmed the full extent of the suspected breach. The National Privacy Commission says it is investigating and coordinating with the DMW.
What does the 68GB of data contain?
Unknown. Hunt.io saw filenames that referenced POEA online services, overseas Filipino worker databases, employment contracts and the Balik-Manggagawa system. It did not examine the contents.
When did the copying happen?
Hunt.io says transfer logs show 27 backup files were copied on 6 September 2026 in about 23 minutes and 46 seconds. The findings were published on 28 October.
Am I affected as an OFW?
It is not known whether the backups hold personal data or whose. Treat any unexpected DMW-related message with caution until the NPC or DMW says more.
How do I report a scam targeting OFWs in the Philippines?
Call the CICC hotline 1326 or report to the PNP Anti-Cybercrime Group. Privacy complaints go to the National Privacy Commission.
Sources
- NPC probes alleged theft of 68GB of DMW-linked database backups, Newsbytes.PH, 2026-10-29
- Philippines probes suspected theft of 68GB of migrant worker data, Gulf News, 2026-10-30
This post summarises public reporting as of 2026-10-30. Details of live incidents change; we update posts when the organization or regulators publish new facts. Spot an error? See our editorial and corrections policy.