Philippine migrant worker data likely leaked, Hunt.io reports 69GB breach

What happened

Threat intelligence firm Hunt.io reports that an unknown operator copied 27 SQL Server backup databases, nearly 69GB in total, belonging to the Philippine Overseas Employment Administration, Dark Reading reports. The agency has not publicly confirmed the incident in the source, and the claim has not been independently verified beyond Hunt.io’s analysis.

According to Dark Reading, Hunt.io’s Oct. 28 analysis was based on logs found in an open directory on a staging server. The server was hosted in the Singapore address space of UpCloud Ltd., a Helsinki-based firm. Hunt.io says the logs show the attacker copying the backups over 24 minutes. The data covered overseas-employment case management, including accreditation, contracts, and cashier and LandBank records.

Hunt.io’s head of research, Esteban Borges, told Dark Reading that the attacker used the GodPotato and SeImpersonate privilege escalation tools and the Impacket Python library to move the data. Hunt.io says the open directory also held a rebranded GodPotato build and a PowerShell stager that unpacks tools in memory.

Borges said the trail stops at the staging server. The server was accessed later, but by whom is not clear. “We still can’t answer ... how they got in, whether the payload ran, and where the data went,” he said. He also said Hunt.io has not seen the backups offered for sale or leaked, and that the firm never opened the backups itself (Dark Reading).

Hunt.io did not attribute the attack. It found some Chinese language fragments in the code, but says that code belonged to a third-party library (Dark Reading).

Hunt.io says it notified CERT-PH and the Department of Migrant Workers (DMW). It declined to share details of their responses. Dark Reading does not report any statement from POEA, DMW or CERT-PH.

Am I affected?

• Overseas Filipino workers with POEA records: the backups reportedly contain worker, contract and payment information. Which individuals are included is not confirmed. Borges told Dark Reading that this kind of data is useful for fraud and identity theft.
• Operators of similar Windows and SQL Server environments: Hunt.io says the migrant-worker portal exposed SMB on port 445 and WinRM on ports 5985 and 47001 (Dark Reading). The initial entry point is not confirmed, so it is not known whether these ports were used.
• CVEs: none are named in the source. Not confirmed.

What to do now

1. Check your internet-facing Windows hosts for exposed SMB (445) and WinRM (5985, 47001). Close or restrict these ports. Hunt.io flagged these ports on the portal (Dark Reading).
2. Review which service and worker accounts hold impersonation privileges, and remove any they do not need. Borges says over-privileged accounts let tools such as SeImpersonate gain more access (Dark Reading).
3. Scan your own network and reduce its attack surface, which is the step Borges recommends for governments in the region (Dark Reading).
4. If your records may be held by POEA or DMW, watch for official notices from DMW or CERT-PH. None are reported in the source so far.

Sources

• Dark Reading: Philippine Migrant Worker Data Likely Leaked in 69GB Government Breach