NPC Issuance Wiki

NPC BN 18-019: In re: Ateneo de Zamboanga University

Issued Resolution

Resolution Text

IN RE: ATENEO DE ZAMBOANGA UNIVERSITY

x----------------------------------------------------x

AGUIRRE, D. P.C.;

Before the Commission is a breach incident involving the unauthorized change in bank account numbers of some of the Ateneo de Zamboanga University - School of Medicine (AdZU) employees resulting in the delay in the payment of salaries.

Facts

On 15 February 2018, a staff member of AdZU called ADC, the payroll officer, to complain about the non-payment of a faculty doctor’s salary for the period of 01 to 15 February 2018.1

Upon checking, ADC discovered the discrepancy in the bank account number in the payroll compared to that submitted by the faculty member.2 According to AdZU, the salaries of forty-two (42) employees were changed to a specific bank account number and resulted to the miscrediting of the employees’ salaries to the wrong bank account.3

Additionally, the bank accounts of two (2) other employees were changed for the payroll period of 15 to 31 January 2018.4

On the same day, the University Human Resources (HR) Director, University Accountant, University Treasurer, and ADC met to discuss the matter.5 They also met with the Data Privacy Officer (DPO) and Director of the Center for Information and Technology Services (CITS) to further investigate the matter.6 AdZU discovered that the account numbers of the employees were changed to the account number of one of the CITS employees, Mr. NB, and the latter’s cousin’s bank account.7

On 16 February 2018, AdZU’s Human Resource and Development Office (HRADO) Director sent a letter to NB to submit a written explanation regarding the crediting of the salaries of the employees.8

On 17 February 2018, AdZU notified the National Privacy Commission (NPC) of the incident.9

On 27 February 2018, NB wrote a letter to the HRADO Director admitting his guilt for tampering with the 31 January and 15 February 2018 payrolls.10 NB explained that he changed the employees’ bank account numbers “due to his great need for money for maintenance medicines and therapy of his ailing mother.”11 He also expressed that “he is the sole breadwinner of the family and had to support the education of his siblings.”12 In his letter, NB described how he was able to get the password of the desktop of the University Treasurer, who regularly approves the payroll and bank transmittal.13

According to NB, he was called one day to the Finance Office to fix the University Treasurer’s computer.14 While fixing the computer, he discovered a malware in a temporary folder.15 It was in this folder where NB said he “s[aw] some passwords and memorize[d] the password of the Treasurer” which he used to gain access to AdZU’s payroll system.16 As a result, he changed the bank account numbers of some of the employees to his bank account number.17

AdZU also reported that NB already admitted his guilt prior to his letter to HRADO through an e-mail sent to his CITS superior on 20 February 2018.18

On 16 March 2022, the NPC, through the Complaints and Investigation Division (CID), ordered AdZU to submit a Post-Breach Report containing the proper documentation on the actions it took:

  1. Description of the personal data breach, its root cause and circumstances regarding its discovery;
  2. Actions and decisions of the incident response team;
  3. Outcome of the breach management, and difficulties encountered;
  4. Compliance with notification requirements and assistance provided to affected data subjects, if any; and
  5. A copy of the report on the investigation on the breach incident, pursuant to the Report dated 17 February 2018.

ATENEO DE ZAMBOANGA UNIVERSITY is hereby given a period of fifteen (15) days from receipt hereof to submit their compliance through email at complaints@privacy.gov.ph.

SO ORDERED.19

On 05 April 2022, AdZU submitted a Post-Breach Report.20

AdZU reported that upon receiving the incident report of the payroll officer in-charge of the HR Office, the Incidence Response Team consisting of the DPO, the Director of the HRADO, and the Director of CITS immediately met.21

The Finance Office requested the bank to freeze the two (2) bank accounts where the salary of the affected employees was credited.22

Additionally, AdZU reported that their CITS immediately reviewed the access logs of the payroll system to determine how the unauthorized changes were made and to identify the perpetrator.23

AdZU also requested assistance from the National Bureau of Investigation (NBI) Cyber Security in Zamboanga City to guide the incident response team for further actions to be taken.24

NB was later found guilty by AdZU for “culpable payroll breach on two separate occasions.”25 AdZU signified that it would not pursue legal action against NB provided that he tender his resignation and return the amount that was deposited in his and the third party’s bank accounts.26 NB issued a promissory note to guarantee his obligation to pay.27

As part of AdZU’s breach management, AdZU reported that the incident prompted CITS to conduct a review of its systems to further increase security and to avoid similar incidents in the future.28

AdZU reported that it immediately disabled all login credentials as soon as the suspect was identified.29 It also reported that it immediately notified its affected data subjects of the incident and credited their salaries.30

AdZU conducted an Information Technology (IT) audit and reviewed appropriate IT policies and procedures.31 It also conducted digital data inventory and put in place appropriate controls and safeguards.32

Additionally, AdZU’s Finance Office updated passwords and other credentials, especially its IT programs and applications.33

Issue

Whether AdZU conducted proper breach management, including the implementation of reasonable and appropriate security measures.

Discussion

The Commission finds that AdZU conducted proper breach management and implemented reasonable and appropriate security measures in addressing the breach. The Commission resolves to close the matter.

Section 20 (a) of Republic Act No. 10173 or the Data Privacy Act of 2012 (DPA) provides that a Personal Information Controller (PIC) should implement reasonable and appropriate measures to protect personal information:

Section 20. Security of Personal Information -

a. The personal information controller must implement reasonable and appropriate organizational, physical and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.34

Similarly, Section 17 (D) (3) of NPC Circular 16-03 (Personal Data Breach Management) provides for the obligation of a PIC to notify the Commission of a personal data breach.35 The provision provides the content of notification specifically the measures that a PIC took to address the breach:

Section 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

…

D. Content of Notification. The notification shall include, but not be limited to:

…

  1. Measures Taken to Address the Breach

a. description of the measures taken or proposed to be taken to address the breach;

b. actions being taken to secure or recover the personal data that were compromised;

c. actions performed or proposed to mitigate possible harm or negative consequences, and limit the damage or distress to those affected by the incident;

d. action being taken to inform the data subjects affected by the incident, or reasons for any delay in the notification;

e. the measures being taken to prevent a recurrence of the incident.36

The Commission recognizes that AdZU complied with its obligation to implement measures to minimize the potential harm and adverse effects of the breach to its employees. Based on AdZU’s submissions, it performed actions that could prevent and mitigate the likelihood of a similar incident.

According to AdZU, there was an immediate investigation conducted by its Incidence Response Team consisting of AdZU’s DPO, Director for HRADO, and the Director for CITS.37 AdZU’s Finance Office then immediately requested the bank to freeze the two (2) bank accounts where the salary of the affected employees was credited.38

AdZU directly sought assistance from the NBI Cyber Security in Zamboanga City to guide AdZU on other actions to be taken.39

AdZU, through its HRADO, immediately informed their employees about the incident and their salaries were promptly credited.40

AdZU also penalized the erring employee and ensured that the money that was still in the bank account of NB was “put on hold and can no longer be withdrawn.”41 AdZU likewise disabled NB’s login credentials on the different resources and programs of the university.42

Internally, the incident caused AdZU to review its systems.43 AdZU’s CITS revisited the access logs of its payroll system to identify the perpetrator.44 It also led AdZU to conduct an IT review audit and digital data inventory to streamline its IT policies and procedures.45

As a security measure, AdZU’s Finance Office secured its programs and applications by updating passwords and other credentials.46

As part of AdZU’s organizational measures, an orientation for the Finance Office on how to secure digital assets was also conducted.47

The Commission notes that there is no evidence on record that indicates that there was lack of appropriate security measures on the part of AdZU. The access to the university’s payroll system was caused by employee malfeasance. While there is no measure that will completely guarantee absolute security, this is all the more true in cases where employee malfeasance is a factor. Nevertheless, the Commission reminds PICs to proactively carry out measures to ensure that security protocols will rule out or mitigate these risks as much as possible.

Based on the foregoing, the actions that AdZU took subsequent to the incident facilitated the enhancement of its organizational, physical, and technical measures pursuant to the DPA and NPC Circular 16-03.

Thus, the actions that AdZU took are sufficient to close the matter.

Dispositive Portion

WHEREFORE, premises considered, this Commission resolves that the matter of NPC BN 18-019 In re: Ateneo de Zamboanga University is CLOSED.

SO ORDERED.

City of Pasay, Philippines.

11 May 2023.

LEANDRO ANGELO Y. AGUIRRE

Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA

Privacy Commissioner

(on official leave)

NERISSA N. DE JESUS

Deputy Privacy Commissioner

Copy furnished:

FR. RVE, S.J.

Data Protection Officer

Office of the Vice President for Administration

Ateneo de Zamboanga University

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Post Breach Report - Report of the Fact-Finding Committee on the case of the Payroll Breach dated 7 March 2018, 5 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  2. Data Breach Notification No. 2018-01, 17 February 2018, at 2, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. at 3. ↩

  6. Id. ↩

  7. Report of the Fact-Finding Committee on the case of the Payroll Breach, 07 March 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  8. Id. ↩

  9. Data Breach Notification No. 2018-01, 17 February 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  10. Report of the Fact-Finding Committee on the case of the Payroll Breach, 07 March 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  11. Id. at 2. ↩

  12. Id. ↩

  13. Id. ↩

  14. Id. at 1. ↩

  15. Id. ↩

  16. Report of the Fact-Finding Committee on the case of the Payroll Breach, 07 March 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  17. Id. ↩

  18. Id. ↩

  19. Order (To Submit Post Breach Report), 16 March 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  20. Post-Breach Report, 05 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. at 2. ↩

  24. Id. at 1. ↩

  25. Letter to Mr. NB, 08 March 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  26. Id. ↩

  27. Promissory Note, 04 June 2018, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2018). ↩

  28. Post-Breach Report, 05 April 2022, at 2, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  29. Letter of the CITS Director to Ateneo de Zamboanga University DPO, 04 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  30. Post-Breach Report, 05 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  31. Letter of the CITS Director to Ateneo de Zamboanga University DPO, 04 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  32. Id. ↩

  33. Id. ↩

  34. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this purpose a National Privacy Commission, and For Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173 § 20 (a) (2012). ↩

  35. National Privacy Commission, Personal Data Breach Management, Circular No. 3, Series of 2016 NPC Circ. No. 16-03, § 17 (D) (3) (15 December 2016). ↩

  36. Id. ↩

  37. Post-Breach Report, 05 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  38. Id. at 2. ↩

  39. Id. at 1. ↩

  40. Id. ↩

  41. Id. ↩

  42. Id. ↩

  43. Post-Breach Report, 05 April 2022, at 2, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  44. Id. ↩

  45. Letter of the CITS Director to Ateneo de Zamboanga University DPO, 04 April 2022, at 1, in In re: Ateneo de Zamboanga University, NPC BN 18-019 (NPC 2022). ↩

  46. Id. ↩

  47. Id. ↩

Backlinks

  • No backlinks found