Around 102 pieces of stolen Philippine data — mostly customer logins and payment card details — surfaced every single day between January and August this year, and ransomware gangs filed more public claims against Philippine organizations in those eight months than in 2024 and 2025 combined. That is the picture in Check Point's 2026 Philippines Threat Landscape Report, first reported by the Daily Tribune and broken down in detail in TechSabado's special feature.
31 ransomware claims in eight months
Check Point counted 31 public ransomware claims involving Philippine organizations from January to August 2026. The combined total for all of 2024 and 2025 was 26. August alone produced 9 claims — nearly double the previous monthly high of 5, against a 2025 monthly average of about 1.4, per TechSabado's breakdown.
The roster of attackers is growing even faster than the attacks. Fifteen ransomware groups posted claims involving Philippine targets this year, up from 12 across all of 2025, and ten of them appeared in Philippine data for the first time. Qilin, the most active group, accounted for 9 claims — 29% of the total, up from 23% last year. Check Point attributes Qilin's share to its large affiliate network rather than any special focus on this country. As the report puts it: "What changed was throughput and participation."
For scale, the Philippines still ranked just 10th out of 11 monitored Asia-Pacific markets by ransomware volume. The worry is the direction, not yet the size.
Government gets the volume, banks get the damage
Across all incident types, Check Point logged 264 cyber incidents affecting Philippine organizations in the period. Most of them — 216 — were website defacements or service disruptions. The remaining 48 were the serious kind: ransomware, breaches, and data leaks.
Government agencies took the highest overall volume with 72 incidents, consistent with the string of agency breaches disclosed in recent weeks that prompted a 24-hour cyber-readiness order to every government agency. Financial institutions faced the highest concentration of severe attacks, with more than half of the sector's incidents involving ransomware, breaches, or leaks. By ransomware claim count, finance and business services led with 6 claims each, followed by retail with 5.
What is actually being stolen
The report tracked 24,875 exposed-data cases in eight months — roughly 102 a day. The breakdown:
- Customer credentials — usernames and passwords for banks, e-wallets, shops, and services: 41.9%
- Payment card data: 23.6%
- Employee credentials leaked through third-party platforms: 10.3%
Nearly 44% of all cases traced back to information-stealer malware — programs that quietly harvest saved logins and session data from infected devices, often picked up from pirated software or fake app downloads.
Scammers now dangle rewards instead of stealing OTPs
Check Point logged 2,386 phishing alerts and flagged a shift in technique: instead of intercepting one-time passwords (the single-use codes sent by banks), attackers increasingly dangle fake rewards and loyalty-program offers so that victims hand over personal and payment details themselves.
Impersonation is growing alongside it: 1,194 social-media impersonation alerts — 972 posing as companies and 222 as executives — up 6% from the same period last year. About four in five cases happened on Facebook, with TikTok second and a favored channel for impersonating executives. The pattern matches the record scam exposure Filipino adults reported this year.
AI is deceiving Filipinos, not hacking them — yet
One finding cuts against the hype: Check Point found no evidence that AI was used to gain technical access to any Philippine organization during the period. "The activity reviewed did not show AI being used to gain technical access to a Philippine organization," the report states. Where AI does appear is deception — deepfake investment scams, cloned voices, manipulated video calls, and fake AI apps that carry malware. The report also warns employees against installing unofficial AI applications on work devices, which can expose credentials, session tokens, files, and corporate access.
If you are hit, call 1326
If money leaves your e-wallet or bank account, or your details turn up in a leak, report it to the government's Inter-Agency Response Center through the toll-free 1326 hotline, which the Cybercrime Investigation and Coordinating Center (CICC) runs 24/7 including holidays, per the Philippine Daily Inquirer. In a past wave of unauthorized e-wallet transfers, the CICC said most victims who reported promptly got their money back — while complaining on social media, it noted, recovers nothing.
For everyone else, the report's numbers point to three cheap defenses: stop reusing passwords (reused customer credentials are the single biggest category of exposed data at 41.9%), turn on two-factor authentication wherever it is offered, and treat any rewards or loyalty-points message as a scam until proven otherwise.
Check Point's homework for 2027
For 2027, the report tells Philippine organizations to prioritize business impact over incident counts, treat identity and session exposure as a standing risk, tighten oversight of third-party providers, and govern how employees use AI at work. "Identity and trust formed the common thread across the report," it concludes — the same thread the new National Cybersecurity Operations Center will be pulling on as it begins watching government systems around the clock.
