Malware Attack Philippines: What to Do, Preserve & Report

Last materially reviewed: September 20, 2026

Direct Answer

If a Philippine business or user discovers malware, the first priorities are to contain the affected device or account, protect credentials, preserve evidence, identify what systems and data were touched, remove the malicious code safely, restore from trusted sources, and decide whether the incident must be reported to a regulator, customer, bank, platform, or law-enforcement authority.

Malware is broader than ransomware. It can include viruses, trojans, spyware, keyloggers, malicious scripts, remote-access tools and other code designed to steal, disrupt, monitor or alter systems. Under Republic Act No. 10175, introducing or transmitting viruses can fall within data interference or system interference when the statutory elements are present.

Key Takeaways

Disconnect before you clean. If malware is active, isolate the affected system from networks where safe so the compromise does not spread.
Preserve evidence before wiping. Keep alerts, logs, suspicious files, timestamps, screenshots, account notices and affected-device details.
Reset credentials from a clean device. Prioritize email, administrator, banking, cloud and recovery accounts.
Do not assume malware equals a reportable data breach. Assess whether personal data was actually affected and whether the NPC notification threshold is met.
Ransomware is one malware category. Use the dedicated ransomware guide when files are encrypted or an extortion demand is involved.

First-Hour Malware Response

Step	What to do
1. Contain	Disconnect the affected device or system from the network where safe. Avoid unnecessary shutdowns if volatile evidence may matter to an investigation.
2. Protect accounts	From a known-clean device, secure administrator, email, finance, cloud and recovery accounts. Revoke suspicious sessions and check MFA changes.
3. Preserve evidence	Save security alerts, logs, filenames, hashes if available, screenshots, suspicious URLs, messages and the incident timeline.
4. Scope the incident	Identify affected users, devices, accounts, websites, servers and data repositories.
5. Stop persistence	Work with qualified IT or security personnel to identify malicious processes, accounts, scheduled tasks, browser extensions, plugins or persistence mechanisms.
6. Recover safely	Restore only after the entry point and persistence mechanisms are addressed. Use known-clean backups and verify restored systems.

Malware vs Ransomware vs Phishing

Malware is malicious software or code. Ransomware is malware designed to deny access to data or systems, commonly paired with extortion. Phishing is a deception technique used to steal credentials, money or information and may be the delivery method for malware.

If files have been encrypted or an attacker is demanding payment, use the Ransomware Attack Philippines guide. If the incident began with a suspicious link or fake login page, use the Clicked a Phishing Link guide.

When Can Malware Be a Cybercrime Under RA 10175?

Republic Act No. 10175 expressly includes the introduction or transmission of viruses in its provisions on data interference and system interference.

Data interference addresses intentional or reckless alteration, damaging, deletion or deterioration of computer data, electronic documents or electronic data messages without right. System interference addresses intentional alteration or reckless hindering or interference with the functioning of a computer or network through specified acts involving computer data or programs.

The exact charge depends on what the malware did, the actor’s intent, authorization, damage and available evidence. Malware may also be connected to illegal access, misuse of devices, computer-related fraud, identity theft or other offenses.

Evidence to Preserve

security-software or endpoint-detection alerts;
malicious file names and locations;
file hashes, where available;
browser history and suspicious download URLs;
email headers and suspicious attachments;
login alerts and authentication history;
firewall, server, endpoint and application logs;
screenshots of pop-ups or attacker messages;
affected device identifiers and user accounts;
backup status and last known-clean restore point;
a chronological record of every response action taken.

Should You Wipe the Device Immediately?

Not automatically. Reimaging may be the correct recovery step, but wiping too early can destroy evidence about the malware’s entry point, persistence, affected accounts, network connections and possible data access. For a serious business incident, preserve what is reasonably needed before rebuilding the system.

When Does Malware Become a Personal Data Breach?

A malware incident becomes a privacy issue when it affects personal data—for example, spyware steals customer records, a trojan gives an attacker access to employee files, or malicious code exposes credentials tied to identifiable people.

The Data Privacy Act and its implementing rules require organizations to assess the incident. The DPA Implementing Rules require notification to the National Privacy Commission and affected data subjects within 72 hours when the statutory breach-notification conditions are met.

Not every malware infection is automatically notifiable. If mandatory-notification elements are not met, the organization should still document the incident and handle it under its security-incident process. See the Data Breach Notification Philippines guide.

Who Should a Business Notify?

Situation	Possible channel
Personal-data breach meeting the notification threshold	National Privacy Commission and affected data subjects through the required process.
Unauthorized banking or payment activity	Bank, e-wallet or payment provider immediately.
Criminal intrusion, malware deployment or related cybercrime	PNP Anti-Cybercrime Group or NBI cybercrime authorities as appropriate.
Hosted website or cloud compromise	Hosting, cloud, domain, SaaS or managed-service provider.
Regulated industry incident	Applicable sector regulator according to its incident-reporting rules.

Business Recovery Checklist

Identify patient-zero device or account if possible.
Determine the likely entry vector.
Remove unauthorized accounts and persistence.
Patch the exploited vulnerability or configuration issue.
Rotate affected credentials and secrets.
Check lateral movement to servers and cloud services.
Validate backups before restoration.
Monitor for recurrence after recovery.
Document impact, decisions and notifications.
Update controls and employee guidance based on the root cause.

Common Mistakes

Deleting suspicious files before recording their names, locations or hashes.
Changing passwords on the infected device.
Restoring a backup without fixing the entry point.
Assuming antivirus removal proves the attacker had no access.
Failing to investigate email forwarding rules, browser sessions or cloud tokens.
Treating malware response as only an IT issue when personal data, fraud or cybercrime may also be involved.

Frequently Asked Questions

Is malware illegal in the Philippines?

Malware-related conduct can violate RA 10175 when it satisfies an offense such as data interference, system interference, illegal access or misuse of devices. The legal result depends on the conduct, intent and evidence.

Do I report every virus infection to the police?

No. Minor infections may be handled internally, but serious unauthorized access, fraud, data theft, extortion or deliberate malware deployment may justify law-enforcement reporting and evidence preservation.

Does a malware infection trigger the NPC 72-hour rule?

Only if the incident is a personal data breach that meets the applicable mandatory-notification conditions. The 72-hour rule is not triggered simply because malware was detected.

Should I pay someone who claims they can remove malware remotely?

Use established IT or cybersecurity providers and verify their identity and scope. Unknown “support” callers can themselves be scammers seeking remote access or payment credentials.

Related Cybercode Guides

Official Sources

Disclaimer

Important: This article provides general legal and cybersecurity information. It is not legal advice, incident-response services or forensic advice. Serious incidents should be assessed by qualified security, privacy and legal professionals as appropriate.

Malware Attack in the Philippines: What to Do, Preserve and Report