Resolution Text
IN RE: BREACH NOTIFICATION REPORT OF PHILIPPINE NATIONAL BANK (PNB)
x----------------------------------------x
NAGA, D.P.C.:
This resolution refers to the security breach notification that the Commission received dated 17 November 2017 from the Philippine National Bank (“PNB”) involving its inControl Portal (“Portal”), a self-service offering for enrolled customers to control the spending of their supplementary credit card.
Facts
The facts are the following:
On 14 November 2017, through the conduct of their regular monitoring of credit card service availability, the PNB’s IT Credit Card Operator reported that the Portal issued a database error response. Following their standard operating procedures on incident reports, PNB conducted an investigation and discovered that the inControl server files are encrypted with the Arena ransomware, which is a kind of malware that infects the victims’ computer with a code that restricts the user’s access to systems and files.
To initially address the security breach, PNB shut down the Portal. Subsequently, the server was removed from the main network to prevent other applications and devices to be infected by the ransomware.
On 17 November 2017, the Commission received the notification from the PNB regarding the security breach that transpired on its Portal.
Through a letter dated 22 November 2017, the PNB stated that according to their initial forensic report, no customer record was compromised, and no other system was impacted by the breach. However, the self-service feature became unavailable, and this affected 655 active and 257 inactive customers, out of 33,000 credit card customers of the PNB.
On 2 July 2018, the PNB has successfully restored the inControl portal. No issues were detected after the conduct of an independent VAPT.
On 13 July 2018, the Commission issued a Compliance Order to PNB requiring them to:
- Submit a report on the status of the security measures being implemented within one (1) month from receipt of the Order; and
- Submit all pertinent documents for remediation within three (3) months from receipt of the Order.
The PNB was able to submit the required reports on 24 August 2018 and 26 July 2019, respectively. The documents provided details on PNB’s implementation of several remediation measures to improve the security of its systems. PNB manifested that they executed the following measures:
- Installed new servers and segregated the application and database servers;
- Upgraded the operating systems, database and secure socket layer (“SSL”) encryption versions;
- Implemented Anti Distributed Denial of Service (“DDOS”) facility and improved Domain Name System (“DNS”); and
- Subjected the new environment to vulnerability and penetration tests (“VAPT”), remediating findings before release to production.
Discussion
On 3 July 2019, the Commission’s Enforcement Division sought the assistance of the Data Security and Technology Standards Division (“DSTSD”) in order to review PNB’s compliance and whether the remediation measures implemented is commensurate with the industry standards.
In the DSTSD report dated 07 August 2019, they concluded that PNB’s remediation measures are at par with the industry standard requirements, specifically the Payment Card Industry Data Security Standard (“PCI DSS”). The DSTSD report also underlined the noticeable improvement on PNB’s security measures after the Commission’s issuance of the 13 July 2018 Order.
The Enforcement Assessment Report dated 13 December 2019 categorically stated that the measures undertaken by PNB complies with the R.A. 10173 or the Data Privacy Act, its Implementing Rules and Regulation, and NPC Circular 16-03 on Personal Data Breach Management. Further, it was recommended that the PNB shall regularly review these measures and policies to further protect the interests of the data subjects.
This Commission, after thoroughly reviewing all the pertinent documents and giving due credence to the evaluation and examination made by its two Divisions, finds that the PNB was able to substantially comply with the Commission’s Compliance Order dated 13 July 2018.
This Commission also notes that no complaint against PNB has been filed in any of its offices in relation to said security breach.
WHEREFORE, premises considered, this Commission hereby resolves that this case be CLOSED.
SO ORDERED.
Pasay City, Philippines. 23 January 2020.
JOHN HENRY D. NAGA
Deputy Privacy Commissioner
WE CONCUR:
RAYMUND ENRIQUEZ LIBORO
Privacy Commissioner
LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner
Copy furnished:
PHILIPPINE NATIONAL BANK ATTN: MR. STY Data Privacy Officer, PNB
ENFORCEMENT DIVISION GENERAL RECORDS UNIT