CICC: Alleged data leak not from GCash, recycled info

The Department of Information and Communications Technology’s Cybercrime Investigation and Coordinating Center (CICC) said Tuesday that the supposed leaked data involving GCash operator G-Xchange Inc. did not originate from the mobile wallet’s systems.

In a statement, CICC said it initiated an investigation into reports of a supposed data breach involving G-Xchange.

This is in connection with a post on the dark web offering GCash account numbers, linked bank and virtual card accounts, and know your customer records containing names, addresses, employment details, and valid Philippine IDs.

The post was made by what the National Privacy Commission described as a “threat actor” using the alias “Oversleep8351.”

The NPC launched an investigation into the alleged data breach, while G-Xchange said that its initial forensic analysis showed that there was no compromise in its systems.

The CICC said its initial assessment found that the data propagated online by the “threat actor” appear to be “recycled information,” which could be an older or previously available data “reused or reshared to appear as newly compromised material.”

“Further examination also shows that the datasets in question do not originate from GCash’s systems,” the agency said.

The CICC said its findings “suggest that there has been no recent compromise of GCash’s infrastructure.”

“In support of ongoing verification efforts, GCash has expressed openness to system checks by the CICC and the Department of Information and Communications Technology to ensure that no potential points of compromise exist,” it said.

The CICC said it is actively pursuing a lead on the possible individual or group behind the reported exposure.

“Investigative efforts are ongoing to verify the origin of the uploaded data and establish any link to previous cyber incidents,” it said.

“The CICC assures the public that all findings will be coordinated with the appropriate authorities as part of due process and in accordance with existing cybercrime investigation protocols,” it added.