DICT denies data leak in eGovPH app 

The Department of Information and Communications Technology (DICT) on Friday denied that there was a data breach on the government’s one-stop mobile application. 

“The Department of Information and Communications Technology (DICT), through its National Computer Emergency Response Team (NCERT) and the eGov Development Team, reports that the eGovPH App remains secure and that the alleged data exfiltration of a threat actor is a hoax,” the department said in a statement. 

Cybersecurity advocacy group Deep Web Konek earlier reported a potential data breach on eGovPH app after a threat actor claimed access to 200,000 know your client (KYC) user data. 

“On November 8, 2024, a forum user under the alias ‘GR3GG3M3RC3R’ posted a message, claiming they had successfully exploited a 0-day vulnerability in the eGovPH system, which is used for various government services in the Philippines,” the group said in a post last November 12.  

“According to the post, the actor was able to gain root access, bypassing security protocols and accessing KYC IDs in the eGovPH database. The individual claims they have dumped and are ready to sell approximately 200,000 IDs,” it added. 

The eGovPH is a single platform where the public can access their digital government IDs and conduct transactions with the government. 

But the DICT affirmed that the mobile application is safe and no threats were found. 

“Results from the initial investigation made by NCERT and eGov show that no large data transfer, user suspicious behavior, or network activity anomaly in the eGovPH System were observed,” the department said. 

“We assure the public that their data on the eGovPH App are safe and the services being provided by the DICT remain secure. We ask everyone to be mindful in sharing content online and rely on official Department channels for accurate information and updates," it added. —LDF, GMA Integrated News