Comelec: Hacker group’s claim of another ‘Comeleak’ a hoax
The Commission on Elections (Comelec) denied on Monday allegations that it has suffered another large-scale hacking similar to the 2016 “Comeleak” incident, which is considered the biggest data breach in the country’s history.
Comelec Chair George Garcia said in an ambush interview that they conducted a verification and countercheck together with the Department of Information and Communications Technology (DICT) to see if a breach indeed happened, but these turned out “negative.”
“We have verified everything, even our website and social media pages of local Comelec offices, if we have been subjected to hacking. We have not been hacked,” Garcia told reporters.
“There are no indicators of compromise, and there is no report from the National Computer Emergency Response Team [of the DICT] that the Comelec has been breached. This is a hoax,” Comelec spokesperson John Rex Laudiangco said.
He noted that based on an initial report, the supposed leaked data currently being peddled on the dark web was from the time the Comelec was hacked in 2016.
Voters’ information
A hacker group calling itself Philippine Cyber Mafia posted on Facebook a video of what it said was “allegedly leaked data” from the poll body.
It hinted at further disclosures and teased a “review” of the supposed data, which included voter registration details such as names and locations, certificates of acceptance from different political parties, and a list of applicants approved for overseas voting—all dated 2012 and 2013.
“These are old data, which might be part of the data breach in 2016,” Laudiangco said.
On March 27, 2016, hacker groups Anonymous Philippines and Lulzsec Pilipinas hacked and defaced the Comelec website with less than two months to go before the presidential elections.
The data breach was named “Comeleak” after the hackers obtained at least 340 gigabytes of data related to 55 million registered voters, including names, birthdays, email addresses and other sensitive personal information.
An information technology graduate identified as Paul Biteng admitted hacking the Comelec website but denied stealing personal data. He was charged but acquitted of charges by a Manila court in February 2020.
According to Laudiangco, the Comelec has since implemented improvements in its cybersecurity to prevent another breach.
He said the current Comelec website only hosts data containing public information.
