The Department of Information and Communications Technology is investigating apossible data exposureinvolving a DICT Trusted Assessment Provider, or D-TAP. In a statement, the agency said initial information indicated that about 410 files linked to 48 companies participating in the accreditation program may have been exposed. The reported collection is approximately 600 MB, or around 770 MB when uncompressed. DICT said the National Computer Emergency Response Team is handling the incident and coordinating with the provider and other relevant parties.
The reported files may includecorporate registration records, permits, certifications, cybersecurity credentials, employment documents, and DICT performance evaluations. Those categories describe what may be in the reported collection, not what investigators have confirmed was accessed. DICT said it is still checking the authenticity, source, nature, and extent of the exposure. The agency has not confirmed that its own systems were breached or that the files are genuine, so the incident remains an active verification exercise rather than a settled breach finding.
D-TAP is part of the Philippines’cybersecurity assurance system. The program accredits trusted firms that conduct vulnerability assessments and security audits for government platforms and critical infrastructure. That makes the reported exposure significant even before investigators establish its scope: accreditation submissions and evaluation records can contain sensitive business and security information. DICT said NCERT is working with the concerned provider to determine the facts and provide assistance. The department also urged the public and media to avoid spreading unverified claims while the investigation continues.
If protected or personal information is confirmed to have been compromised, DICT said it will take appropriate action, including notifying affected parties when applicable under theData Privacy Act of 2012and related rules. For now, the key confirmed development is the government’s investigation, not a confirmed leak or system intrusion. Viper.ph will update this report when DICT releases validated findings about the source, affected records, possible notification duties, or any impact on Philippine government cybersecurity operations and systems.
