CyberCode.ph · Philippines

What to Do After a Business Cyberattack in the Philippines

Last updated October 11, 2026 · Practical privacy, cybersecurity and technology-law guidance
Security operations team reviewing systems during the first hours of a business cyberattack response

What Should a Philippine Business Do First After a Cyberattack?

Do three things before anything else. Write down the exact date and time you learned of the incident and who learned of it. Name one person who can authorise disconnection, spending and notification. Isolate the affected systems from the network without powering them off. That recorded moment of knowledge is what starts every Philippine deadline that follows — two hours to the Bangko Sentral if you are a supervised financial institution, and 72 hours to the National Privacy Commission and to the affected people if personal data may have been exposed.

Everything else follows from those three. The ordered sequence is set out in the first hour, in order; the deadlines each kind of incident triggers are in the clocks that start the moment you know; the question that decides whether the 72-hour duty exists at all is in is this a personal data breach?; and the channel the notification has to travel through is in how the notification actually reaches the Commission.

Key Takeaways

  • Write down the time you knew. Every Philippine reporting clock runs from knowledge or reasonable belief, not from the attack itself.
  • Two hours, not 72, if you are a bank or other BSP-supervised institution. Section 148 of the Manual of Regulations for Banks requires notification of a reportable major cyber-related incident within two hours of discovery, with a follow-up report within 24 hours.
  • Containment and evidence pull against each other. Reformatting a machine ends the infection and ends the investigation at the same time.
  • Not every cyberattack is a personal data breach. NPC Circular 16-03 sets a three-part test, and all three limbs must be met before the 72-hour notification duty is triggered.
  • Your service provider’s logs have a six-month life. Republic Act No. 10175 requires traffic data and subscriber information to be preserved for a minimum of six months from the date of the transaction — which is the practical reason to report early rather than after the clean-up.
  • The Cybercrime Investigation and Coordinating Center does not take complaints. RA 10175 gives enforcement to the National Bureau of Investigation and the Philippine National Police.
  • The notification has to travel through the DBNMS, and a late one is presumed missing. The National Privacy Commission states that it accepts Personal Data Breach Notification Forms through the Data Breach Notification Management System only, and that failure to notify is presumed if it receives nothing within five days.
  • Asking the Commission for an exemption or a postponement does not stop the clock. NPC Advisory No. 2026-02, dated 11 May 2026, states that the Commission’s inaction on such a request “shall not be construed as an approval, implied consent, or automatic grant”.

Jump to a Section

Decision Snapshot

Question in the first hour Practical answer
Should we shut everything down? No. Isolate what is affected. A blanket shutdown destroys volatile evidence and stops the business at the same time.
Should we reformat the infected machine now? No, not before its scope and contents are captured. Reformatting is the single most common way Philippine businesses lose their own case.
Should we pay a ransom? Payment is a separate decision with its own legal exposure. See Cybercode’s ransomware payment guide before deciding.
Do we have to tell the National Privacy Commission? Only if the incident meets all three limbs of the NPC Circular 16-03 test. Assess it; do not assume either way.
How long do we have? 72 hours to the NPC and to affected data subjects. Two hours to the Bangko Sentral if you are a supervised institution.
Does the clock start when we were attacked? No. It starts on knowledge or reasonable belief that a personal data breach has occurred.
Can we delay because we are still investigating? Only within narrow limits, and not at all where at least 100 data subjects or any sensitive personal information is involved.
Should we report to the police or the NBI? Yes, where a cybercrime offence is in play. RA 10175 gives enforcement to the NBI and the PNP.
Will the CICC take our complaint? No. RA 10175 gives the CICC coordination and policy functions, not complaint intake.
Who tells customers? One named person. Uncoordinated statements before the scope is known create a second problem.

The First Hour, In Order

The order matters more than the speed. Most of the damage Philippine businesses do to themselves in an incident is done in the first hour, by well-meaning staff destroying the record of what happened while trying to make it stop.

Step Action Why this order
1 Record the date and time you first knew, and who knew it. Every Philippine deadline in this guide runs from knowledge or reasonable belief. If you cannot say when you knew, you cannot show you notified on time.
2 Name one incident owner and one decision-maker who can authorise disconnection, spending and notification. Section 5 of NPC Circular 16-03 requires a data breach response team with at least one member holding authority to make immediate decisions on critical action.
3 Isolate affected systems from the network. Do not power them off if you can avoid it. Isolation stops spread. Powering off destroys memory-resident evidence that a forensic examiner would otherwise recover.
4 Move coordination off the possibly-compromised channel. If the attacker is in the mail system, your incident plan is being read as you write it.
5 Secure the crown-jewel accounts: domain registrar, email administration, cloud console, identity provider, online banking, accounting. Attackers pivot. One compromised mailbox with password-reset access reaches every other system.
6 Check for the quiet changes: new mail forwarding rules, altered recovery addresses, new multi-factor devices, new administrator accounts. These survive a password reset. A reset alone does not evict an attacker who has added their own second factor.
7 Confirm backups exist, are offline or immutable, and are not themselves encrypted. A backup the attacker can reach is not a backup. This determines whether you have a recovery option at all.
8 Start a written timeline and keep adding to it. This is the document the NPC, your bank, your insurer and a prosecutor will each ask for.
9 Ask the personal-data question explicitly, out loud, and record the answer. The 72-hour clock is already running whether or not anyone has thought about it.

For the detailed containment sequence and a printable version, use Cybercode’s cyber incident response checklist, and for the governance structure that should already exist before an incident, the incident response plan guide.

The Clocks That Start the Moment You Know

Philippine reporting deadlines are often described as though there were one, and it were 72 hours. There are several, they come from different instruments, they run to different recipients, and the shortest of them is two hours. Which ones apply to you depends on what kind of business you are and what kind of data was involved.

Clock Who it binds Runs from To whom Source
2 hours BSP-supervised financial institutions only Discovery of a reportable major cyber-related incident The appropriate supervising department of the Bangko Sentral MORB Sec. 148
24 hours BSP-supervised financial institutions only The same discovery The Bangko Sentral, as a follow-up report MORB Sec. 148
72 hours Any personal information controller or processor Knowledge of, or reasonable belief in, a personal data breach The National Privacy Commission, through the DBNMS NPC Circular 16-03, Sec. 17(A)
72 hours Any personal information controller or processor The same moment of knowledge or reasonable belief The affected data subjects NPC Circular 16-03, Sec. 18(A)
5 days Any personal information controller The date of discovery The NPC, as the full breach report NPC Circular 16-03, Sec. 17(C)
72 hours Any person or service provider served with a court-warranted order Receipt of the order Law enforcement RA 10175, Sec. 14

Two points that competing guidance tends to blur. First, the 72-hour clock to the Commission and the 72-hour clock to the affected people are two separate duties running in parallel from the same moment — notifying one does not discharge the other. Second, the five days is the deadline for the full breach report, not a longer alternative to the 72 hours. Cybercode sets all of this out step by step in the data breach reporting guide and in the DBNMS breach notification guide.

If You Are a BSP-Supervised Institution, Your Clock Is Two Hours

Section 148 of the Bangko Sentral’s Manual of Regulations for Banks, on Information Technology Risk Management, sets the shortest incident clock in Philippine regulation. A supervised institution must “notify the appropriate supervising department of the Bangko Sentral within two (2) hours from discovery” of a reportable major cyber-related incident. A follow-up report is due “within twenty-four (24) hours from the time of the discovery” of that incident.

This matters because most published incident advice assumes 72 hours is the Philippine standard. For a bank, an e-money issuer or another BSP-supervised financial institution, a response plan built around 72 hours has already failed by the time anyone opens it. Two hours is not enough time to investigate; it is enough time to pick up the phone, which is what the rule contemplates.

Section 148 also allocates responsibility above the IT department. The board of directors is ultimately responsible for understanding the IT risks the institution faces, while senior management is accountable for designing and implementing the IT risk management system the board approved. The section frames that system in four components: IT governance, risk identification and assessment, implementation of IT controls, and risk measurement and monitoring. In a supervised institution, an unreported incident is a governance failure, not only a technical one.

If you are not BSP-supervised, this clock does not apply to you. An ordinary Philippine company — a retailer, an agency, a BPO, a SaaS business, a clinic — has no two-hour regulatory duty. It still has the privacy clocks below, and it may have contractual notification duties to customers or to a client whose data it processes, which are frequently shorter than anything the law requires. Read your contracts before you read the statute.

Is This a Personal Data Breach?

Not every cyberattack is a personal data breach, and the distinction decides whether the 72-hour duty exists at all. A defaced marketing website with no customer records behind it is an incident; it is usually not a notifiable personal data breach. A compromised email account holding years of client correspondence almost certainly is.

NPC Circular 16-03 defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed. Section 11 of the same circular then sets the notification test, and all three limbs must be present.

Limb What it requires The question to ask in the first hours
(A) The breach involves sensitive personal information, or any other information that may be used to enable identity fraud Was there anything in the affected system that would let someone impersonate a customer or an employee — ID numbers, dates of birth, account details, health or financial records?
(B) There is reason to believe the information may have been acquired by an unauthorised person Is there evidence of exfiltration, or of access by someone who should not have had it? Encrypted-at-rest data on a lost device with no sign of decryption is the classic place this limb fails.
(C) The unauthorised acquisition is likely to give rise to a real risk of serious harm to any affected data subject What could actually be done to these people with what was taken?

If all three are met, both 72-hour clocks run from the moment of knowledge or reasonable belief. Section 17(B) permits delay only to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the system, and it adds that a delay “shall not be excused if it is used to perpetuate fraud or to conceal the personal data breach”. Section 17(C) then imposes two absolute hard stops: there is to be no delay where the breach involves at least one hundred data subjects, or where the disclosure of sensitive personal information will harm or adversely affect the data subject. Above either threshold, “we were still investigating” is not available as a reason, and the Commission must still be notified inside the 72-hour period.

The consequences of getting this wrong are not only administrative. Section 30 of the Data Privacy Act makes concealment of a security breach involving sensitive personal information a criminal offence reaching natural persons, punishable by imprisonment of one year and six months to five years and a fine of not less than ₱500,000 and not more than ₱1,000,000, and it can be committed by omission — but it requires knowledge both of the breach and of the Section 20(f) duty to notify. Separately, NPC Circular 2022-01 classifies failure to notify regarding data breaches as a major infraction, drawing a fine of 0.25% to 2% of the annual gross income of the immediately preceding year, subject to an overall cap of ₱5,000,000 for a single act.

The full assessment, the exemption and postponement routes, and the contents of the notification are set out in Cybercode’s step-by-step data breach reporting guide. For the threshold question of what counts as personal data at all, see the Data Privacy Act guide, and for the regulator itself, the National Privacy Commission page.

How the Notification Actually Reaches the Commission

Deciding that you must notify is not the same as having notified. The National Privacy Commission states on its own breach reporting page that since the Data Breach Notification Management System launched, “the Commission accepts submission of PDBNFs through the System ONLY”. A notification sent by any other route is not a valid notification, and the Commission adds that “failure to notify shall be presumed if the Commission does not receive notification” within five days. For a business in its first hours, that means someone has to hold a working DBNMS account before it is needed; the Commission advises creating the account with the Data Protection Officer’s dedicated office email, because that address becomes the username and has to survive a change of officer.

If you cannot notify in the ordinary way, the system also carries three requests, and NPC Advisory No. 2026-02, dated 11 May 2026, sets out which of them can be asked for together.

Request What it asks for What Advisory No. 2026-02 says
Exemption from notifying data subjects Release from the duty to tell the affected people at all It cannot be requested at the same time as a postponement or alternative means for the same incident; mutually exclusive requests may be denied
Postponement of notification More time before the affected people are told It may be availed of concurrently with a request for alternative means
Alternative means of notification Notice given by a route other than individual notice It may be availed of concurrently with a request for postponement
The full breach report The complete account of the incident Unless the Commission acts on a request, it goes to admindbnms@privacy.gov.ph within five days from discovery, with the subject line FBR_NameofPIC_NameofDPO

Three things in that advisory change how a business should behave on day one. First, a request buys nothing by itself: “The Commission’s inaction shall not be construed as an approval, implied consent, or automatic grant” of it, and non-compliance can still draw an administrative fine under NPC Circular No. 2022-01. Second, the advisory treats a breach as one incident where it involves the same data subjects, the same data and the same nature of breach, so a business cannot reset its clock by re-filing as the picture widens — changes in the number of affected data subjects or in the data elements involved belong in the full breach report. Third, submitting through the system does not relieve the business of its underlying obligations under NPC Circular No. 16-03.

What to do about this today, before an incident: confirm who holds the DBNMS account and that the email behind it still works, and keep the five-day full-report address and subject-line format with your incident plan rather than looking for them at two in the morning. Cybercode sets out the submission route step by step in the DBNMS breach notification guide and the full assessment in the data breach reporting guide.

What to Preserve, and Why Six Months Matters

The instruction “gather evidence” is useless at two in the morning. What follows is the specific material that Philippine responders, regulators, insurers and prosecutors actually ask for, and the reason each item matters.

What to preserve Why it matters How it is usually lost
Authentication and sign-in logs, with source IP addresses and timestamps Establishes when the attacker got in and from where. This is the backbone of any later warrant application. Log retention set to 30 days by default in the cloud console.
Mail flow and audit logs, including rule-creation and delegation events Shows mailbox forwarding rules and added delegates — the persistence a password reset does not remove. Deleted with the mailbox during clean-up.
The original phishing message, with full internet headers The headers carry routing information the message body does not. A forwarded copy loses them. Forwarded instead of saved, or deleted by the recipient out of embarrassment.
Ransom notes, wallet addresses and attacker communications Identifies the campaign and is the only record of what was demanded. Wiped with the machine.
Disk or memory images of affected machines, taken before remediation Memory-resident artefacts exist only while the machine is powered on. Powering off, then reformatting.
Firewall, VPN, EDR and server logs covering the whole suspected window Shows lateral movement and outbound transfers that the endpoint alone does not. Rotated out before anyone thinks to export them.
Transaction records and payment instructions, where money moved The bank will ask for these before it will act, and so will the prosecutor. Held only in a compromised mailbox.
A dated written timeline of detection and every action taken Fixes the moment of knowledge from which every clock runs. Never started.
Screenshots of defacement, ransom screens and error states Captures what the system looked like before it was restored. Restored from backup first, photographed never.
The list of affected data subjects and data categories Required for the notification and for the five-day full breach report. Reconstructed from memory weeks later.

Why six months is the number that should change your behaviour

Republic Act No. 10175, the Cybercrime Prevention Act of 2012, places a preservation duty on service providers, not on you. Section 13 requires that “the integrity of traffic data and subscriber information…shall be preserved for a minimum period of six (6) months from the date of the transaction”. Content data is treated differently: it is preserved for “six (6) months from the date of receipt of the order from law enforcement authorities requiring its preservation”, and law enforcement “may order a one-time extension for another six (6) months”.

Read those two sentences together and the practical consequence is stark. The connection records that would identify who reached your systems sit with a telecommunications company or a hosting provider on a six-month timer that started on the day of the attack, not on the day you noticed. The content data timer does not start at all until law enforcement issues an order — which they cannot do until you report. A business that spends four months quietly cleaning up and then decides to pursue the matter may find the records it needs have already aged out. This is the single strongest operational argument for reporting early, and it is absent from most guidance on this question.

Section 13 also provides that once preserved data is used as evidence, “the mere furnishing to such service provider of the transmittal document to the Office of the Prosecutor shall be deemed a notification to preserve” the data until the termination of the case. Service providers are separately required to keep any preservation order they receive confidential.

An obligation businesses do not expect

Section 15 of RA 10175 governs search, seizure and examination of computer data under a warrant. Within it sits a duty that catches companies by surprise: law enforcement “may order any person who has knowledge about the functioning of the computer system…to provide, as is reasonable, the necessary information” to protect and preserve the data. Your system administrator can be required to assist. Section 15 also allows law enforcement to secure the system, copy the data, maintain its integrity, conduct forensic examination and render data inaccessible, with court-approved extensions of up to thirty days to complete an examination. Section 16 then requires that within forty-eight hours of the warrant’s expiration, everything examined is deposited with the court in a sealed package, with an affidavit of access and a certification that no unauthorised duplicate was made.

Two further provisions are worth knowing before you act. Section 18 states plainly that “any evidence procured without a valid warrant or beyond the authority of the same shall be inadmissible for any proceeding before any court or tribunal.” And Section 20 makes failure to comply with a lawful order under Chapter IV a violation of Presidential Decree No. 1829, punishable by imprisonment or a fine of ₱100,000, or both, for each and every instance of noncompliance. Cybercode’s electronic evidence guide covers how this material is later authenticated, and the RA 10175 guide sets out the Act section by section.

One thing this page will not tell you: whether a Philippine court has ruled on how any of these provisions operate in practice. Supreme Court material could not be retrieved from a primary government source when this page was reviewed, so no case is cited and no judicial interpretation is asserted anywhere on it. Readers who need that should start at the Supreme Court of the Philippines.

Where to Report, and What a Report Actually Consists Of

Philippine businesses routinely lose a day working out who to call. The allocation is set by statute and it is narrower than the public discussion suggests.

Body What RA 10175 gives it Use it for
National Bureau of Investigation Section 10 makes the NBI and the PNP responsible for enforcement; each must organise a cybercrime unit manned by special investigators exclusively handling violations of the Act. Filing a criminal complaint and requesting investigative assistance.
PNP Anti-Cybercrime Group The same Section 10 grant. The same, and the route named in RA 11313 for gender-based online sexual harassment.
DOJ Office of Cybercrime Created by Section 23 as central authority for mutual assistance and extradition. Section 11 requires the NBI and PNP units to submit pre-operation, post-operation and investigation reports to the DOJ. Prosecution and any cross-border dimension. It is not a public complaint desk.
Cybercrime Investigation and Coordinating Center Sections 24 to 26 give it policy coordination and the national cybersecurity plan. No complaint-intake, investigative, arrest, warrant or prosecution power appears anywhere in those sections. Policy and coordination. Not your complaint.
National Privacy Commission The breach notification regime under RA 10173 and NPC Circular 16-03. The personal-data side, through the DBNMS. A separate track from the criminal one.
Bangko Sentral ng Pilipinas MORB Sec. 148, supervised institutions only. The two-hour and 24-hour notifications.
Your bank Contractual and regulatory, not under RA 10175. Recall attempts on fraudulent transfers, which lose value by the hour.

Cybercode’s guide to reporting cybercrime sets the routing out in full, and the cybercrime reporting directory maps agency to incident type. The CICC page explains why the coordination body is not the complaint desk.

What filing with the NBI actually involves

The NBI publishes its cybercrime service in its Citizen’s Charter. The service is Investigative Assistance for Victims of Computer Crimes, run by the Cybercrime Division. It is available to the general public, lists no checklist of requirements, charges no fee, and gives a total processing time of one hour and ten minutes. The published steps are: the complainant goes to the Cybercrime Division and personnel assist in completing the complaint sheet; an Agent or Special Investigator conducts a preliminary interview and initial investigation, assists in completing the sworn complaint sheet and prepares a request for authority to investigate; the complainant and witnesses execute sworn statements or submit prepared affidavits while agents collect supporting documents and evidence; and the complaint sheet and request for authority go to the Office of the Deputy Director for Investigation for approval before returning to the Division. Complaints filed outside NBI headquarters are handled by Regional Cybercrime Centers using the same process.

Two practical notes. The NBI publishes a Filinvest Cyberzone Bay, Diosdado Macapagal Boulevard, Pasay City address for the Bureau, while the Citizen’s Charter entry refers to complaints filed outside NBI Taft headquarters. Cybercode reports both and asserts neither — confirm the office before anyone travels. And because the complaint sheet is sworn and witnesses execute sworn statements, the people who saw the incident should come with their recollection already written down.

What a prosecutor will need later

If the matter proceeds to a complaint for preliminary investigation, the Department of Justice publishes what the filing consists of, and the volume surprises most businesses. An Investigation Data Form must be duly accomplished and certified under oath in two copies. The complaint-affidavit or sworn statement of the complainant is required in five copies plus the number of respondents. The affidavit of each witness is required in the same quantity. Supporting documents, across thirteen offence-specific categories, are required in the same quantity again. Where a victim or offender is a minor, a birth certificate or affidavit of age is required, plus a certificate of discernment under Republic Act No. 9344 where applicable. The DOJ gives office hours of Monday to Friday, 8:00 a.m. to 4:30 p.m. with no noon break.

The DOJ page publishes no procedural timeline and no step sequence — it states what must be filed, not how long anything takes. Cybercode does not supply a timeline it could not verify.

What could not be verified, and is therefore not published here

The Cybercrime Investigation and Coordinating Center’s own website could not be read from a primary government source when this page was reviewed; its root and its complaint page both refused the request. No CICC email address, phone number or office address is published on this page, and any such address circulating elsewhere should be confirmed with the agency before use. The PNP Anti-Cybercrime Group’s site publishes operational news but no mandate statement, hotline, email or address, so no PNP-ACG contact detail is published here either. The DOJ Office of Cybercrime maintains its own site, which describes the Office as the “Central Authority in all matters relating to international mutual assistance and extradition” for cybercrime and as the “focal agency in formulating and implementing law enforcement investigation and prosecution strategies” — but it publishes no contact details and no reporting procedure. A separate government news release dated 31 December 2025 describes hotline 1326 as an Inter-Agency Response Center line operated jointly by the CICC, DICT, NPC and NTC for reporting online scams. That is a news report of a service, not an issuance, and it is not a route for filing a criminal complaint.

Recovering Without Re-Infecting

Recovery fails when it is treated as the moment the incident ends rather than the moment it is most likely to repeat. Restoring a system that still contains the attacker’s access simply resets the clock on the same breach.

  1. Establish how they got in before you restore. Restoring without closing the original route is the most common cause of a second incident within weeks.
  2. Rebuild rather than clean, where you can. A rebuilt machine from known-good media has no inherited persistence; a cleaned one might.
  3. Rotate every credential the compromised system could reach, including service accounts, API keys, and any password reused elsewhere. Revoke active sessions and tokens, not just passwords.
  4. Remove the attacker’s own persistence: added administrator accounts, registered multi-factor devices, mail forwarding rules, OAuth application grants, scheduled tasks and modified recovery addresses.
  5. Verify backups before you trust them. Restore to an isolated environment first and confirm the backup predates the compromise, which is often earlier than the detection date.
  6. Patch the exploited weakness, and check whether the same weakness exists on systems that were not attacked.
  7. Monitor deliberately for re-entry for a defined period afterwards, with someone responsible for looking.
  8. Keep the evidence you preserved even after recovery. The regulatory and criminal tracks run for months after the technical one closes.

The IRR of the Data Privacy Act is explicit that the security obligation is continuing rather than one-off: Rule VI requires reasonable and appropriate organisational, physical and technical measures, and Section 29 requires those measures to be subject to regular review and updating, with adequacy judged on the nature of the data, the risks posed by the processing, the size of the organisation and complexity of its operations, current best practices, and the cost of implementation. The proportionality in that test is what makes it workable for a small business. Cybercode’s cybersecurity guide sets out the baseline, and the backup and recovery guide covers restoration in detail.

Six Worked Scenarios

1. Ransomware encrypts the file server of a 40-person logistics firm

Isolate the server and any machine sharing its credentials, but leave it powered on. Confirm whether the backups are offline; if they are, recovery is a technical problem rather than a negotiation. The personal-data question turns on what was on that server: employee records and customer identification documents will usually satisfy limb (A) of the Circular 16-03 test, and ransomware operators who exfiltrate before encrypting will usually satisfy limb (B). If all three limbs are met, both 72-hour clocks are already running from the moment the encryption was discovered. The firm is not BSP-supervised, so there is no two-hour clock. The payment decision is separate and carries its own exposure — see the ransomware payment and reporting guide and the immediate ransomware response guide.

2. A rural bank discovers unauthorised access to its core banking system at 11 p.m.

The two-hour clock under MORB Section 148 is the controlling deadline and it runs from discovery, not from the start of the next business day. The notification is due to the appropriate supervising department of the Bangko Sentral, with the follow-up report within 24 hours of the same discovery. The privacy analysis runs in parallel on its own 72-hour clock and does not displace the BSP duty. Both are owed; neither satisfies the other.

3. A finance officer wires ₱2.4 million after an emailed instruction that turns out to be fraudulent

Money first: call the bank immediately and ask for a recall, because the prospect of recovery decays by the hour. Then preserve the message with full internet headers, not a forwarded copy, together with the mailbox audit log showing any forwarding rule the attacker created. Check whether the mailbox itself was compromised or whether the domain was merely spoofed, because the answer changes whether this is also a personal data breach. Cybercode covers the pattern in the business email compromise guide and the resulting fraud analysis in the online estafa guide.

4. A marketing website is defaced, and nothing else is touched

Preserve a screenshot and the server logs before restoring, then restore from a backup that predates the compromise and close the route in. If the site held no personal data and there is no indication any database behind it was reached, limb (A) of the notification test is not met and there is no NPC notification duty — but that conclusion should be recorded with the reasoning that supports it, not simply assumed. See the hacked website guide.

5. A laptop holding a customer spreadsheet is stolen from a car

This is the cleanest illustration of limb (B). If the disk was fully encrypted, the device was powered off, and there is no indication the passphrase was compromised, there is a defensible basis for concluding that the information was not acquired by an unauthorised person. That reasoning, and the evidence supporting each element of it, should be documented at the time. If the laptop was unencrypted or was left logged in, limb (B) is satisfied and the assessment moves to limb (C).

6. A cloud vendor tells a BPO client that the vendor was breached

Accountability does not transfer with the processing. Where a controller subcontracts or outsources, it remains accountable for the actions of its processor, and the controller’s own notification duty to the Commission and to affected data subjects is unaffected by the fact that the failure happened at the vendor. Get the vendor’s incident timeline in writing immediately, because your 72 hours runs from your knowledge or reasonable belief, and a vendor that takes a week to tell you has consumed none of your clock but all of your options. Check what your data processing agreement actually requires the vendor to do, and how quickly.

Ten Mistakes That Cost Philippine Businesses the Most

  1. Reformatting the machine first. It ends the infection and the investigation at the same moment.
  2. Not recording when you knew. Every clock on this page runs from that moment, and a business that cannot evidence it cannot show it notified on time.
  3. Resetting passwords and stopping there. A reset does not remove a forwarding rule, an added multi-factor device, an OAuth grant or a second administrator account.
  4. Treating 72 hours as the only deadline. It is not the deadline for a BSP-supervised institution, and it is not the deadline for the full breach report.
  5. Deciding there was no breach without recording the reasoning. The decision may well be right. Unrecorded, it is indistinguishable from never having asked.
  6. Delaying notification to finish investigating, above the hard stops. Where at least 100 data subjects or any sensitive personal information is involved, Section 17(B) permits no delay at all.
  7. Coordinating the response in the compromised mail system. The attacker reads the plan as it is written.
  8. Reporting to the wrong body and waiting. The CICC coordinates; it does not take complaints. Days spent waiting for a response that was never coming are days off the six-month preservation window.
  9. Waiting months before reporting to law enforcement. Traffic data and subscriber information are preserved for a minimum of six months from the transaction, and content data preservation does not begin until an order is issued.
  10. Calling recovery the end. The regulatory track, the criminal track and the contractual track all continue after the systems come back.

What not to do at all

  • Do not attempt to access the attacker’s systems. Unauthorised access is itself an offence under RA 10175 regardless of who accessed you first, and it converts a victim into a respondent.
  • Do not alter, crop or annotate original evidence. Work from copies and keep the originals untouched.
  • Do not publish a scope figure before you have one. A number retracted later is more damaging than a statement that the assessment is ongoing.
  • Do not let individual staff answer customer or media questions. One named person, with what is actually known.
  • Do not destroy the evidence to protect the reputation. Concealment of a breach involving sensitive personal information is a criminal offence reaching individuals, not only the company.

Frequently Asked Questions

What should a Philippine business do first after a cyberattack?

Three things, in this order. Record the date and time it learned of the incident, and who learned of it. Name one person with authority to disconnect systems, spend money and authorise notification. Isolate the affected systems from the network without powering them off. Containment matters enormously, but the moment of knowledge is what starts every Philippine reporting deadline, and it is the one piece of information that cannot be reconstructed afterwards.

Does emailing the National Privacy Commission count as notifying it?

No. The Commission states on its breach reporting page that it accepts Personal Data Breach Notification Forms through the Data Breach Notification Management System only, and that failure to notify is presumed if it receives nothing within five days. The one filing it directs to an email address is the full breach report: NPC Advisory No. 2026-02 sends that to admindbnms@privacy.gov.ph within five days from discovery where the Commission has not acted on a request made through the system.

Do we have to report every cyberattack to the National Privacy Commission?

No. The notification duty arises only where all three limbs of the NPC Circular 16-03 test are met: the breach involves sensitive personal information or information that may enable identity fraud; there is reason to believe it may have been acquired by an unauthorised person; and that acquisition is likely to give rise to a real risk of serious harm. An incident that fails any limb is still an incident to be documented, but it is not a notifiable personal data breach.

Is the deadline 72 hours or five days?

Both, for different things. The Commission and the affected data subjects must each be notified within 72 hours of knowledge or reasonable belief. The full breach report is due within five days of discovery. The five days is not an extension of the 72 hours.

Does the 72 hours start when we were attacked?

No. It runs from knowledge of, or reasonable belief in, a personal data breach. An intrusion that went unnoticed for three months starts its clock when it is discovered, not when it began — though a business that should reasonably have known earlier is on weaker ground.

We are a bank. Is our deadline different?

Yes, and it is much shorter. Section 148 of the Manual of Regulations for Banks requires notification to the appropriate supervising department of the Bangko Sentral within two hours of discovering a reportable major cyber-related incident, with a follow-up report within 24 hours. The privacy clocks run in parallel and are not satisfied by the BSP notification.

Should we shut down all our systems?

Usually not. Isolate what is affected rather than halting the business, and avoid powering machines off where you can, because memory-resident evidence exists only while they are running. A blanket shutdown is occasionally the right call, but it should be a decision rather than a reflex.

Can we just reformat the infected computer?

Not before its contents and scope are captured. Reformatting destroys the forensic record of how the attacker got in, what they reached and what they took — which is also the record you need for the NPC notification, the insurance claim and any criminal complaint.

Who do we report a cyberattack to in the Philippines?

The criminal track goes to the National Bureau of Investigation or the PNP Anti-Cybercrime Group, which RA 10175 Section 10 makes responsible for enforcement. The privacy track goes to the National Privacy Commission through the DBNMS. A BSP-supervised institution also notifies the Bangko Sentral. Where money moved, the bank should be contacted immediately and separately.

Will the CICC handle our complaint?

No. Sections 24 to 26 of RA 10175 give the Cybercrime Investigation and Coordinating Center policy coordination and responsibility for the national cybersecurity plan. Those sections confer no complaint-intake, investigative, arrest, warrant or prosecution power. Complaints go to the NBI or the PNP.

How much does it cost to report to the NBI, and how long does it take?

The NBI’s published Citizen’s Charter entry for investigative assistance to victims of computer crimes lists no fee and gives a total processing time of one hour and ten minutes across four steps. That is the intake, not the investigation.

Our vendor was breached, not us. Is that our problem?

Yes, where the vendor was processing personal data on your behalf. Accountability stays with the controller even when processing is subcontracted or outsourced, and your notification clock runs from your own knowledge or reasonable belief. Ask the vendor for a written timeline immediately.

Can we be fined for not reporting?

NPC Circular 2022-01 treats failure to notify regarding data breaches as a major infraction, attracting a fine of 0.25% to 2% of the annual gross income of the immediately preceding year, subject to a cap of ₱5,000,000 for a single act. Separately, Section 30 of the Data Privacy Act makes intentional concealment of a breach involving sensitive personal information a criminal offence reaching individuals.

Should we tell customers before we know the full scope?

Where the notification duty applies, the 72-hour clock does not wait for a complete picture, and above the Section 17(B) hard stops no delay is permitted at all. Say what is known, say what is not yet known, and say what you are doing. A retracted figure is worse than an incomplete one.

Verification Log

Cybercode publishes what it checked, when, and what it could not reach. The first table below records the source recheck carried out on 11 October 2026. The second records what was checked on earlier reviews of this page.

Checks made on 11 October 2026

Source What was asked of it What it returned
MORB Section 148 The notification deadlines, and who is responsible above the IT department Read. The two-hour and twenty-four-hour wording was quoted verbatim and confirmed, as were the board and senior-management allocations and the four ITRMS components
NPC Circular No. 16-03 Sections 5, 11, 17(A) to (D) and 18(A) Read. The two hard stops sit in Section 17(C), not 17(B); this page said 17(B) and was corrected
NPC breach reporting page Which channel a notification must travel through, and what happens if nothing arrives Read. The DBNMS-only rule and the presumption of failure to notify after five days were both confirmed and are new to this page
NPC Advisory No. 2026-02 The exemption, postponement and alternative-means requests, and the full-report route Read in full for the first time on any review of this page. The new section above was built from it
NPC advisories index Whether a later breach-notification advisory exists Read. Advisory No. 2026-02 is the current one; No. 2026-03 of 8 September 2026 concerns annual security incident reports for 2025
RA 10175, Senate copy Sections 13 to 16, 18 and 24 to 26 Read. The six-month preservation period, the one-time extension, the seventy-two-hour disclosure period and the CICC’s coordination-only functions were all confirmed
RA 10173, NPC copy Sections 20(c), 20(f) and 30 Read. The Section 30 fine runs from ₱500,000 to ₱1,000,000; this page gave only the floor, and the ceiling was added
NPC Circular No. 2022-01 The fine tiers and the cap for a single act Read. Major infraction 0.25% to 2%, grave infraction 0.5% to 3%, and the ₱5,000,000 cap for a single act were confirmed
NBI Citizen’s Charter The cybercrime service entry behind the fee and timing figures on this page Not re-read. The live charter page now lists only clearance services, and the charter handbook PDF refused automated retrieval. Those figures are carried forward from the 9 October 2026 reading
PNP Anti-Cybercrime Group site A hotline, email address or office address for reporting None published. The site carries operational news only, so this page still publishes no PNP-ACG contact details

Checks recorded on earlier reviews

In the table below, “Verified this review” refers to the review of 26 September 2026, not to the recheck above.

Claim Source Status
Two-hour notification and 24-hour follow-up report for a reportable major cyber-related incident MORB Sec. 148, morb.bsp.gov.ph Verified this review, quoted directly
RA 10175 Sec. 13 — six-month preservation of traffic data and subscriber information; content data and one-time extension; evidence transmittal rule Senate Legislative Digital Resource Verified this review, quoted directly
RA 10175 Sec. 15 — duty of knowledgeable persons to assist; thirty-day examination extension Senate Legislative Digital Resource Verified this review, quoted directly
DOJ Office of Cybercrime mandate as central authority and focal agency cybercrime.doj.gov.ph Verified this review. No contact details and no reporting procedure are published on it
NPC pre-incident expectations and the three reporting clocks NPC breach reporting procedures page, dated 12 February 2022 Verified this review. Informational page, not an issuance
NPC Circular 16-03 Secs. 11, 17(A)–(D), 18(A) — three-part test, clocks, delay limits and hard stops NPC Circular 16-03 Verified previously and reused, not re-fetched this review
RA 10173 Secs. 20(c), 20(f), 30 and IRR Rule VI Secs. 25–29 National Privacy Commission Verified previously and reused, not re-fetched this review
NPC Circular 2022-01 fine tiers and the ₱5,000,000 cap NPC Circular 2022-01 Verified previously and reused, not re-fetched this review
RA 10175 Secs. 10, 11, 14, 16, 18, 20, 21, 23, 24–26 Senate Legislative Digital Resource Verified previously and reused, not re-fetched this review
NBI Citizen’s Charter cybercrime service — no fee, one hour ten minutes, four steps National Bureau of Investigation Verified previously and reused, not re-fetched this review
DOJ preliminary-investigation documentary requirements and office hours Department of Justice Verified previously and reused, not re-fetched this review
Hotline 1326 as an Inter-Agency Response Center line Philippine Information Agency release dated 31 December 2025 Government news report of a service, not an issuance. Cited as reported
IRR of RA 10175 cybercrime.doj.gov.ph/irr/ Could not be read. The path refused the request on this review
CICC contact details cicc.gov.ph Could not be read. None published on this page as a result
PNP Anti-Cybercrime Group hotline, email or address acg.pnp.gov.ph Not published by the agency. None published on this page as a result
Any Philippine court decision on RA 10175 or the breach regime Supreme Court of the Philippines Could not be read. No case is cited anywhere on this page
NBI office location NBI homepage and Citizen’s Charter Discrepancy flagged, not resolved. Both statements reported; confirm before travelling

Official Sources

About This Guide

Author: Cybercode.ph Editorial Team. Sources rechecked as of: October 11, 2026.

This guide has not been reviewed by a named external legal reviewer, and Cybercode does not attribute review to a person who has not carried it out. In place of a reviewer’s name, the verification log above records exactly which primary sources were read on each recheck, which were reused from an earlier verified reading, and which could not be reached at all.

If you believe something on this page is wrong or out of date, check it against the primary source cited for that claim in the verification log — the Bangko Sentral for the two-hour clock, the National Privacy Commission for the breach regime, and the Senate copy of Republic Act No. 10175 for the preservation and evidence provisions — and tell us what you find.

Disclaimer

Important: This article provides general educational information about Philippine law, regulation, cybersecurity, technology, or business compliance. It is not legal advice and does not create an attorney-client relationship. Laws, agency procedures, technical standards, platform rules, and the facts of each situation may change the result. Verify current requirements through the cited official sources and seek qualified professional advice when your rights, deadlines, money, safety, or legal exposure may be affected.

CyberCode updates

Get practical updates on Philippine technology law, data privacy, cybersecurity, and AI.

Email activity tracking

Unsubscribe any time. See our privacy policy below.