NPC Issuance Wiki

NPC BN 23-090: In re: Asalus Corporation

Issued Order

Order Text

IN RE: ASALUS CORPORATION NPC BN 23-090

x----------------------------------------------------x

ORDER

Before the Commission is Asalus Corporation’s (Asalus) request for postponement from the notification requirement to the affected data subject through the Data Breach Notification Management System (DBNMS) dated 29 March 2023.1

In its Initial Report, Asalus (doing business under the name and style of Intellicare) stated that as early as February of 2023, a vulnerability from its GoAnywhere Managed File Transfer Solution Tool (GoAnywhere MFT) was publicly disclosed alongside zero-day exploitation.2 A security patch recommended by Fortra was deployed to Asalus a week later.3

Asalus also reported that on 25 March 2023, a tweet was posted by a certain FalconFeedsio stating that Intellicare was included in the list of companies that were subjected to CL0P ransomware “perpetrated by unknown individuals who took advantage of a vulnerability known as CVE-2023-0669 found in GoAnywhere [MFT].”4 According to Asalus, the said tool is used by many of its clients in the Philippines and abroad, including Intellicare.5

On 27 March 2023, Asalus’ Communications Head saw the posted tweet and reported the incident to its Information Security Officer and Data Privacy Officer.6 On the same day, Asalus held series of meetings to determine the accuracy of the report.7

On 28 March 2023, Asalus found that there were unauthorized access logs to one of its servers connected to GoAnywhere tool.8

Subsequently, Asalus stated that on 29 March 2023, it informed its clients of the situation and notified the Commission regarding the incident.9

According to Asalus, initially, no data subject was affected by the incident as the same is yet to be determined.10 Moreover, Asalus reported to the Commission that the personal data involved in the incident are yet to be determined.11

In addressing the breach, Asalus reported that it undertook the following measures:

  1. Activated our Incident and Data Breach Response Plan and informed our Global Data Protection Officer and Global Information Security Officer of this alleged attack. Global team has provided us help through the activation of our Threat Intelligence Service to check for possible data leaks related to Intellicare.

  2. Information Technology and Information Security Teams of Intellicare are independently investigating the matter.

  3. Took down all public facing portals. This decision was made with abundance of caution to ensure no data will be compromised if indeed, there was exfiltration.

  4. Disabled GoAnywhere. Note, we have not used this product yet to transmit files as we are still undergoing remediation efforts as recommended by our Infosecurity Team on the basis of the Vulnerability and Penetration Testing Findings discovered last 22 November 2022. While this may be the case, the tool was up and running, and was connected to the internet at the time of the exploit.

  5. Perform scans of firewalls and security information and event management systems.

  6. Continue malware scanning of servers and networks.

  7. Continue to monitor network and cloud traffic on the IP Addresses outgoing the gateway.

  8. Monitor all quarantined emails for any possible notification from the purported hacker/s. No email has been received from anyone claiming to have perpetrated the alleged attack.

  9. Coordinate with Fortra to determine the extent of the event.12

In notifying the data subjects, Asalus requested that the same be put on hold as the extent of the incident is not yet determined.13 Thus, Asalus requested to postpone the notification as it cannot determine if “personal information stored in [its] systems has been compromised.”14

Accordingly, the Commission issued a Minute Resolution dated 18 April 2023 requiring Asalus to submit proof to substantiate its request for postponement:

Pursuant to Section 17 (D) of NPC Circular No. 16-03 (Personal Data Breach Management), the Commission may require additional information, if necessary, for the proper resolution of the requests for postponement to notify affected data subjects and extension of thirty (30) days to submit its full report.

WHEREFORE, premises considered, the Commission hereby ORDERS Asalus Corporation to SUBMIT within five (5) days upon receipt of this Minute Resolution proof to substantiate the requests for postponement to notify affected data subjects and extension of thirty (3) days to submit its full report.

Should Asalus Corporation fail to provide the foregoing, this matter shall be submitted for resolution based on the records before the Commission.

SO ORDERED.15

In compliance therewith, Asalus submitted its Interim Report dated 24 April 2023 and stated that there was data exfiltration which affected Asalus and one of its clients, IQOR (Philippines) (IQOR).16 Asalus stated that as far as it is concerned, only the names of its active employees were affected, and no personally identifiable information was exposed.17

However, as to IQOR, personal data belonging to twenty-two thousand five hundred twenty-nine (22,529) data subjects were exfiltrated from the GoAnywhere tool.18 According to Asalus, the personal data involved were complete names, birthdates, sex, HMO account numbers, room and board benefits, maximum benefit limit, and the relationship of the dependents with their principal.19

Asalus claimed that no sensitive or critical information was involved, thus, there is minimal risk of financial loss or identity theft on the part of the data subjects because of the nature of the data exposed.20 Lastly, Asalus noted that the data subjects affected are IQOR’s former or active employees and their dependents.21

In the same Interim Report, Asalus stated that it exerted reasonable efforts to notify the 22,529 data subjects.22 Asalus attached a sample letter-notification allegedly sent to nine thousand two hundred twenty-nine (9,229) principal members.23 Asalus also noted that the ten thousand nine hundred five (10,905) affected data subjects are the dependents of the principal member who are their family members, spouses, children, or partners.24 In this regard, Asalus sought assistance to its principal members to cascade the notification to their dependents.25

Alongside with the sample letter-notification submitted by Asalus, it also attached its Data Breach and Security Incident Response Plan,26 Advisory issued to its clients on 29 March 2023,27 updated Advisory issued to its clients on 05 April 2023 stating that “there was no demonstrable proof of data exfiltration,”28 a letter-notification to IQOR,29 Final Update on the Investigation by Mandiant,30 an Updated letter-notification to clients whose data are not affected,31 and the Frequently Asked Questions (FAQs) on Confirmed Data Breach.32

On 03 May 2023, Asalus submitted a letter to the Commission requesting an extension of filing of its Full Breach Report until 15 May 2023.33 Subsequently, Asalus submitted its Full Breach Report dated 15 May 2023.34

Rule V, Section 18(B) of NPC Circular No. 16-03 (Personal Data Breach Management) provides:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

B. Exemption or Postponement of Notification. If it is not reasonably possible to notify the data subjects within the prescribed period, the personal information controller shall request the Commission for an exemption from the notification requirement, or the postponement of the notification.

A personal information controller may be exempted from the notification requirement where the Commission determines that such notification would not be in the public interest or in the interest of the affected data subjects. The Commission may authorize the postponement of notification where it may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.35 (Emphasis supplied)

In this case, Asalus stated that it cannot determine whether personal information has been compromised pending its investigation.36 However, Asalus stated in its Interim Report that 22,529 members of IQOR were exfiltrated from the GoAnywhere tool37 which contain personal and sensitive personal information such as complete names, birthdates, sex, HMO account numbers, room and board benefits, maximum benefit limit, and the relationship of the dependents with their principal.38 Thus, Asalus should have notified the identified data subjects of the incident based on the information readily available at the time of the investigation.

Further, Asalus’ claim that there is minimal risk of financial loss or identity theft since there are no sensitive or critical information involved,39 cannot be sustained. Chapter V, Section 20(f) of the Data Privacy Act of 2012 (DPA) states:

(f) The personal information controller shall promptly notify the Commission and affected data subjects when sensitive personal information or other information that may, under the circumstances, be used to enable identity fraud are reasonably believed to have been acquired by an unauthorized person, and the personal information controller or the Commission believes that such unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject. The notification shall at least describe the nature of the breach, the sensitive personal information possibly involved, and the measures taken by the entity to address the breach. Notification may be delayed only to the extent necessary to determine the scope of the breach, to prevent further disclosures, or to restore reasonable integrity to the information and communications system.40 (Emphasis supplied)

Applying the cited provision, Asalus cannot do away with notifying the affected data subjects by merely stating that no sensitive personal information were involved in this case. In its Initial Report to the Commission, Asalus already stated that “unauthorized access logs were found in one of [its] server connected to GoAnywhere.”41 Asalus also reported that the incident “[m]ay lead or have lead sic to exfiltration of data.”42 These statements from Asalus is deemed an admission that a breach incident has occurred which may give rise to a real risk of serious harm to the affected data subjects.

Moreover, Asalus has failed to show that the pending investigation of the incident is a criminal investigation contemplated by the foregoing provision for the Commission to grant Asalus’ request for postponement.

Nevertheless, Asalus was able to submit sample notification letters allegedly sent to the affected data subjects.43 In its Full Breach Report, Asalus stated that seventy-nine percent (79%) of its principal members affected by the incident were already informed through registered email addresses.44 Also, Asalus reported that the remaining twenty-one percent (21%) were notified through alternative means designed internally which Asalus call as DataCheck which allows the members of Intellicare to verify if their data were compromised.45

Based on the foregoing, the Commission considers the request for postponement moot as Asalus claimed to have notified the affected data subjects evidenced by a sample letter-notification attached to its Full Breach Report.46 With this, Asalus is required to submit proof of such notification to the Compliance and Monitoring Division (CMD).

Lastly, in implementing measures to address the breach, Asalus made a report on the following policies and their corresponding attachments:

  1. Vendor Management Policy;47
  2. Access Control Management Policy48 and Privileged Account Management Policy;49
  3. System and Service Acquisition Policy;50
  4. Vulnerability Management Policy;51
  5. Vulnerability Assessment and Penetration Testing (VAPT) Report;52
  6. Vendor Risk Assessment Report;53 and,
  7. Information Technology & Security Incident Management Policy.54

The Full Breach Report with various proofs of implementation of measures to address the incident are noted and shall be endorsed to the Compliance and Monitoring Division (CMD) for evaluation and appropriate action.

WHEREFORE, premises considered, the Commission hereby:

  1. NOTES the Compliance of Asalus Corporation (Asalus) with the Minute Resolution dated 18 April 2023;

  2. DIRECTS Asalus to submit proof of notification to the affected data subjects to the Compliance and Monitoring Division (CMD) within fifteen (15) days from the receipt of this Order; and,

  3. DIRECTS CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of Asalus’ data breach notification and assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).

SO ORDERED.

City of Pasay, Philippines. 03 August 2023.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

(on official leave) NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

JED Data Privacy Officer Asalus Corporation

DFA Information Security Risk Officer Asalus Corporation

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT

Footnotes

  1. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of Asalus Corporation (29 March 2023). ↩

  2. Id., 1.b Chronology of Asalus Corporation. ↩

  3. Id. ↩

  4. Id. ↩

  5. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Brief Summary of Asalus Corporation (29 March 2023). ↩

  6. Id., 1.b Chronology of Asalus Corporation. ↩

  7. Id. ↩

  8. Id. ↩

  9. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Asalus Corporation (29 March 2023). ↩

  10. Id., 1.c Number of DS/Records of Asalus Corporation. ↩

  11. Id., 2.a SPI and 2.b Other info that may enable identity fraud of Asalus Corporation. ↩

  12. Id., 3.a Measures to address the breach of Asalus Corporation. ↩

  13. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 3.d Action to inform data subjects? of Asalus Corporation (29 March 2023). ↩

  14. Id., Justification for postponement of Asalus Corporation. ↩

  15. NPC BN 23-090 (unreported), Minute Resolution dated 18 April 2023, at p. 1. ↩

  16. Interim Report dated 24 April 2023 of Asalus Corporation, at p. 4 ↩

  17. Id. ↩

  18. Id. ↩

  19. Id. ↩

  20. Interim Report dated 24 April 2023 of Asalus Corporation, at p. 4 ↩

  21. Id. ↩

  22. Id., at p. 5. ↩

  23. Id., referred to as Annex “G” ↩

  24. Interim Report dated 24 April 2023 of Asalus Corporation, at p. 5. ↩

  25. Id. ↩

  26. Id., referred to as Annex “B” ↩

  27. Id., referred to as Annex “C” ↩

  28. Interim Report dated 24 April 2023 of Asalus Corporation, referred to as Annex “D” ↩

  29. Id., referred to as Annex “E” ↩

  30. Id., referred to as Annex “F” ↩

  31. Id., referred to as Annex “H” ↩

  32. Interim Report dated 24 April 2023 of Asalus Corporation, referred to as Annex “I” ↩

  33. Letter Request dated 03 May 2023 of Asalus Corporation. ↩

  34. Full Breach Report dated 15 May 2023 of Asalus Corporation. ↩

  35. National Privacy Commission, Personal Data Breach Management, NPC Circular 16-03, rule V, § 18(B) (15 December 2016) (NPC Circular 16-03). ↩

  36. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Justification for postponement of Asalus Corporation (29 March 2023). ↩

  37. Interim Report dated 24 April 2023 of Asalus Corporation, at p. 4 ↩

  38. Id. ↩

  39. Id. ↩

  40. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for This Purpose a National Privacy Commission, and for Other Purposes Data Privacy Act of 2012, Republic Act No. 10173, chapter V, § 20(f) (2012). ↩

  41. In re: Asalus Corporation, NPC BN 23-090, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Asalus Corporation (29 March 2023). ↩

  42. Id., 1.e Likely Consequences of Asalus Corporation. ↩

  43. Full Breach Report dated 15 May 2023 of Asalus Corporation, referred to as Annex “H” ↩

  44. Id., at pp. 5 and 7. ↩

  45. Id., at p. 7. ↩

  46. Id., referred to as Annex “H” ↩

  47. Full Breach Report dated 15 May 2023 of Asalus Corporation, referred to as Annex “L” ↩

  48. Id., referred to as Annex “M” ↩

  49. Id., referred to as Annex “N” ↩

  50. Id., referred to as Annex “O” ↩

  51. Full Breach Report dated 15 May 2023 of Asalus Corporation, referred to as Annex “P” ↩

  52. Id., referred to as Annex “R-1” ↩

  53. Id., referred to as Annex “R-2” ↩

  54. Id., referred to as Annex “S” ↩

Backlinks

  • No backlinks found