Hunt.io Says Logs Show 69GB Copied from Philippine Migrant Worker Agency
Summary
Hunt.io says staging-server logs show an unknown attacker copied 27 Philippine Overseas Employment Administration backup databases, nearly 69GB of worker and financial data. The data’s destination is unknown; Hunt.io has not seen it offered for sale.
Key points
- Hunt.io’s analysis of logs from a Singapore-based staging server showed a transfer of 27 backup databases completed in about 24 minutes.
- The copied data reportedly included overseas-employment case-management, accreditation, contract, cashier and LandBank records.
- Hunt.io identified GodPotato, SeImpersonate and the Impacket Python library among tools and files associated with the activity.
- Hunt.io assessed the compromise as confirmed, but said the available evidence did not establish how the attacker gained access or where the data went beyond the staging server.
- The company said it had not seen the backups offered for sale or published in a leak, and notified CERT Philippines and the Department of Migrant Workers.
- Hunt.io also reported risky exposed ports on the migrant-worker portal, including SMB and WinRM.
Article Details
- Victim Organization
- Philippine Overseas Employment Administration
- Incident Type
- Unauthorized access to databases and exfiltration of data
- Data Types Exposed
- Personally identifiable information of overseas workers
- Employment case-management information
- Accreditation records
- Contracts
- Cashier records
- LandBank records
- Affected Records
- 27 backup databases
- Affected Data Size
- Nearly 69GB
- Operational Impact
- Logs reportedly showed the attacker copying the databases over 24 minutes. The article reports no further operational disruption.
- Ransom Or Extortion
- No ransom or extortion was reported. Hunt.io had not seen the data offered for sale or appearing in a leak.
- Claim Status
- confirmed
People
Vendors
Tools
GodPotatostaging server used by the attacker. The cyberattackers used privileged escalation tools, namely GodPotato and SeImpersonate, and the Impacket network library for Python to move the data, but the trail stoppedImpacketThe cyberattackers used privileged escalation tools, namely GodPotato and SeImpersonate, and the Impacket network library for Python to move the data, but the trail stopped at the staging server, says EstebanSeImpersonateused by the attacker. The cyberattackers used privileged escalation tools, namely GodPotato and SeImpersonate, and the Impacket network library for Python to move the data, but the trail stopped at the staging