Do you enjoy using a mobile wallet for a wide range of digital transactions, such as sending and receiving money, paying bills, and shopping online?
You might want to give it some thought, as the National Privacy Commission (NPC) has begun investigating an alleged data breach involving GCash operator G-Xchange Inc., which has denied the accusation and asserted that its systems are still secure.
Based on several reports, the NPC, which oversees the country’s compliance with international data protection standards, stated that its Complaints and Investigation Division has sent G-Xchange Inc. a notice to explain in order to gather more information about the reported incident.
This development followed a dark web post by a “threat actor” identified by the NPC as “Oversleep8351,” who was allegedly offering GCash account numbers, linked bank and virtual card details, as well as know-your-customer (KYC) records containing names, addresses, employment information, and valid Philippine IDs.
Furthermore, GCash released its official statement this Monday, October 27, on its verified Facebook page.
“NO EVIDENCE OF DATA BREACH. Your funds and information are safe and secure,” they said.
“GCash is aware of an online post alleging that user information is being sold on the dark web.”
“There is no evidence of any breach in GCash systems. All customer accounts and funds remain secure.”
“Upon swift investigation by our cybersecurity experts, the alleged dataset does not match data from GCash systems. Additionally, many entries are incomplete, invalid, or do not belong to GCash users.”
“These findings strongly indicate that the data being circulated did not originate from GCash.
We continue to work closely with the BSP, NPC, and CICC to monitor and validate information from all possible sources and ensure that our systems remain protected.”
“GCash remains fully committed to safeguarding customer data, strengthening our defenses, and upholding the trust of millions of Filipinos,” they added.
