Ransomware Attack Left Philippines’ DTI Without Nearly a Year of Accounting Records
Summary
A ransomware attack disrupted the Philippines’ DTI accounting database. COA reported that inaccessible cloud backups and no offline copies left the agency rebuilding records with documents obtained from auditors.
Key points
- COA’s 2025 annual audit report said a ransomware attack on December 21, 2025, disrupted DTI’s accounting database.
- DTI recovered records only through January 23, 2025, and had to reenter transactions for much of the year, delaying financial statements.
- The database was on a shared server; cloud backups were inaccessible, and DTI had no alternative offline or physical backups.
- DTI also lacked retained copies of key accounting vouchers and supporting documents, so it sought copies from COA.
- COA recommended a separate server, regular secure backups, an additional offline copy, and retaining accounting documents. DTI agreed.
- COA found DTI’s December 31, 2025 financial statements fairly presented, with no material errors or omissions affecting reported balances.
Article Details
- Victim Organization
- Department of Trade and Industry (DTI)
- Incident Type
- Ransomware attack
- Incident Date
- 2025-12-21
- Data Types Exposed
- Accounting records
- Financial documents
- Transaction records
- Affected Records
- Nearly a year’s worth of transactions required reconstruction; the exact number of records was not reported.
- Operational Impact
- DTI could recover accounting records only through January 23, 2025. Its Accounting Division had to reenter transactions covering most of the year, delaying preparation of financial statements. Cloud backups were inaccessible, and no alternative offline or physical backups had been maintained.
- Ransom Or Extortion
- No ransom or extortion activity was reported.
- Claim Status
- confirmed