Filipino pawn shop breach leaks 900k clients’ data

Email server trespass exposes sensitive information

A security breach at Filipino pawn shop Cebuana Lhuillier has exposed the personal data of 900,000 clients.

The company, which has more than 1,500 branches nationwide, confirmed that around 3% of its customer records were breached after a marketing email server was compromised.

Attempts to access one of Cebuana’s servers were detected on January 15. The company later discovered that unauthorized downloads had taken place on August 5, 8, and 12, 2018.

Leaked information could include dates of birth, addresses, and details related to sources of income.

A statement from Cebuana Lhuillier read: “Upon discovery, we immediately coordinated with the National Privacy Commission (NPC) to investigate the matter, and already implemented safety measures to protect the personal data of our clients.”

It added: “Transaction details or information were not compromised. The company’s main servers remain safe and protected.”

Privacy commissioner Raymond Liboro of the NPC said the organization was investigating the incident.

The huge data breach comes just days after Foreign Secretary Teodoro Locsin claimed that a private contractor took personal data from the passport office after a dispute.

French contractor Oberthur Technologies denied making off with sensitive documents after its contract to service passport printing machines was terminated.

Hours after a meeting between the NPC and the Department of Foreign Affairs (DFA), the government confirmed that no data was taken and that the information belonging to passport holders was “safe”.

A statement from the DFA read: “The Department assured the Commission that it takes extremely seriously the protection of the personal information of the public and that all passport data is safe. The Department remains in custody and control of passport data and that this has not been shared with or accessed by any unauthorized party.

“The Department is hoping that it was able to address the concerns of the Commission and remains ready to cooperate, especially with Congress, in any other investigation to be conducted on this issue.

“The Department is also hoping that it was able to assuage the concerns of the public on this issue that has also resulted in improvements in the passport application process.”