CYBERATTACKS in the Philippines intensified in the first half of 2026, with more than 19.2 million credentials compromised and 255 data breach incidents exposing about 335 million records, according to Viettel Cyber Security (VCS).
The firm’s Cyber Threat Landscape Report recorded 16,619 phishing attacks and 21 ransomware incidents nationwide during the six-month period. Finance, hospitality, logistics, manufacturing and energy were among the sectors most affected.
VCS also identified 34,650 new vulnerabilities, including 77 high-impact cases affecting products and services widely used in the Philippines. Unpatched systems remained key entry points for targeted attacks.
The 255 data breaches exposed about 2.6 terabytes of data, highlighting the growing scale of cyber risks facing businesses and consumers.
Financial institutions were among the major targets. Coordinated attacks between March and April compromised around 99 million records, while a separate breach involving a public-service organization exposed another 45 million records.
In another incident, attackers extracted about 1.8 terabytes of confidential internal data from financial institutions after deploying malicious payloads within enterprise systems.
VCS said cybercriminals are increasingly using artificial intelligence (AI), stolen credentials and leaked personal information to automate phishing and create convincing deepfake voices and videos. These can be used to impersonate bank employees, government officials or relatives and trick victims into disclosing one-time passwords or authorizing fraudulent transactions.
Romance scams, fake recruitment schemes and delivery fraud using leaked data were also identified as rising threats.
The report said stronger cybersecurity measures are being pursued, including enhanced requirements for financial institutions under the Bangko Sentral ng Pilipinas’ Anti-Financial Account Scamming Act and cybersecurity initiatives by the Department of Information and Communications Technology.
VCS said compliance alone is no longer sufficient and recommended continuous threat intelligence, real-time monitoring, vulnerability management and employee cybersecurity awareness to help organizations contain attacks. / KOC