SEC Confirms Data Breach Involving Platform Users, Notifies Privacy Commission

The Philippine SEC functions as the country's corporate registrar, holding filings, taxpayer numbers and contact records for every registered entity, including the growing roster of crypto exchanges and fintech firms that must register as corporations before offering services. The Data Privacy Act of 2012 obliges it to report incidents to the National Privacy Commission, which is how this breach, uncovered on November 6, became public rather than staying buried in an internal log.

Businesses and individuals on the SEC's rolls, including crypto firms that filed incorporation papers, now face a real risk their Tax Identification Numbers, names and addresses are circulating outside the agency's systems. Expect phishing attempts using real TINs to look legitimate, pressure on the Bureau of Internal Revenue to flag suspicious filings tied to leaked numbers, and registered companies auditing which of their officers' personal data sat in SEC databases.

A registrar that aggregates TINs and addresses for every regulated entity is a single point of failure by design, and that cuts against the pitch crypto and fintech firms make to regulators that digitized, centralized recordkeeping is safer than paper. The SEC insists passwords and core databases were untouched, but the gap between that claim and separate reports of leaked record sets shows how contested the actual scope of a breach can stay.

The total crypto market fell 1.0% in the 4 hours after the first headline, after falling 0.6% in the 2 hours before.

48 prices, one every 30 minutes