If a company or government agency says your personal data may have been exposed, first verify the notice through a trusted official channel. Then find out what information may be affected and secure the accounts or financial services that could be at risk.
An exposure notice does not automatically mean someone has taken over your account. It also does not mean every type of information the organization holds was exposed. The response should match what is known, while recognizing that investigations can change.
The National Privacy Commission (NPC) said on November 10 that it had received personal data breach notifications from several government agencies, including the BIR, DICT, DOLE, DTI and SEC. It reminded the public to stay vigilant against phishing, fraudulent messages and identity theft that may exploit concern over reported breaches. A notification to the NPC does not establish that every user of an agency’s services was affected.
Verify the notice independently
Do not rely on a link or phone number in an unexpected message. Open the service’s official app, type its known website address yourself or contact it through a number you already trust. Ask whether the notice is genuine, whether your information is included and what the organization recommends.
A real-looking message can still be a scam. Never give a caller your password, one-time password or bank PIN to “verify” your identity or reverse an alleged breach.
Check which information was involved
An exposed email address can lead to convincing phishing messages. A reused password raises the risk of someone attempting to sign in elsewhere. Bank or payment details call for prompt contact with the relevant provider. An exposed identity document can be used in impersonation attempts.
If the organization cannot yet confirm what was affected, ask when it expects an update. Save the notice and record the date, but avoid sharing the notice or other people’s data publicly.
Secure your accounts
If a password may be compromised, change it through the service’s official site or app. Change it on any other account where you reused it, too. Use a unique password for each account, and consider a reputable password manager.
Turn on two-step verification where available. Review recent sign-ins, active sessions and recovery email or phone details, then sign out unfamiliar sessions using the provider’s security controls. Secure your main email account especially carefully because it may be used to reset other passwords.
Watch for suspicious activity
Check bank, e-wallet and other relevant accounts for transactions you do not recognize. Contact the provider immediately through an official channel if you see one, and follow its instructions for securing the account and disputing the transaction.
Be cautious with calls, texts and emails that mention details about you. A scammer’s knowledge of your name or a past transaction is not proof that they represent the organization. TechPipino’s guide to GCash unauthorized transactions and our explainer on fake-receipt scams give more context.
Keep records and follow up
Keep copies of relevant notices, transaction references and correspondence without exposing sensitive details. Ask the organization for updates and its data protection contact if you need clarification. The NPC publishes information on data privacy and complaints at privacy.gov.ph. Check its current official instructions before submitting personal information.
Frequently asked questions
Does every exposure require a new password?
Not necessarily. If no password was involved, the most relevant action may be watching for impersonation or securing a financial account. Change a password promptly if it may have been exposed, reused or used in suspicious sign-ins.
Can two-step verification prevent every attack?
No. It adds a barrier, but scammers can still try to trick you into sharing a code or approving a sign-in. Never approve a request you did not start.
Should I click a link in the notice?
Use a known official app or website instead. Even if a notice appears genuine, going to the service yourself reduces the risk of following an impersonation link.
Takeaway
Confirm the facts, prioritize the accounts and information at risk, and stay alert for follow-up scams. Keep watching for updates, because the organization may learn more as its investigation progresses.
