NPC Issuance Wiki

NPC BN 22-094: In re: Equicom Savings Bank

Issued Resolution

Resolution Text

IN RE: EQUICOM SAVINGS BANK

x----------------------------------------------------x

NAGA, P.C.;

Before the Commission is a request for postponement from the requirement of notification of affected data subjects dated 01 July 2022 filed by Equicom Savings Bank (Equicom) in relation to an unauthorized transfer of funds from the bank accounts of Equicom’s depositors.

Facts

On 01 July 2022, Equicom submitted to the Commission an initial report of a data breach through the Data Breach Notification Management System (DBNMS).1

On 29 June 2022 at around 10:58 A.M., a complaint for an unauthorized debit on the account of Delictable, Inc. (Delictable) was received by the Sales Officer of Equicom-Diliman Branch.2 Upon inquiry of Delictable’s bank account, it was revealed that fund transfers were made via Instapay.3

Equicom noted that a total amount of one hundred fifty thousand pesos (Php 150,000.00) was transferred to three (3) GCash recipients crediting fifty thousand pesos (Php50,000.00) to each.4

At 11:00 AM, an internet banking transaction report was generated to verify the transactions allegedly made by Delictable.5 It was noted that the account name AJM bore Delictable’s account number “instead of the legitimate account name of Delictable.”6

Further, it was also reported that several Equicom branches “were also appearing to be used by AJM.”7 Equicom stated that it deactivated AJM’s account at the branch level.8 In the report, it was stated that Branch Head JL and Service Officer RDL called the other branches to inform them of the possible unauthorized debits of their depositors.9

Equicom claimed that the perpetrator managed to use the “Inspect Elements” feature of the Chrome web browser, and that “the account number of the Source Account was eventually changed to other account number[s] of existing [Equicom] depositors.”10 Consequently, a simulation test was made by the IT Department of Equicom to mimic the process.11

As for personal data involved, Equicom mentioned in its Initial Report that the depositors’ account numbers may be used to identify fraud.12 The possible sensitive personal information involved was reported as “to be determined” by Equicom.13

Equicom identified nineteen (19) affected data subjects from four (4) Equicom branches and noted that there are sixty-seven (67) unauthorized fund transfers through Instapay involving the total amount of Three Million Seventy-Seven Thousand Four Hundred Fifty-Six pesos (Php3,077,456.00).14

In terms of the measures to address the breach, Equicom stated that it “strengthen security measures process both in front end and API”.15 Further, to secure/recover the personal data and to mitigate harm, it stated that the “internet banking facility [was] immediately shut down”,16 and that the “internet banking facility will be down for 10 days due to deployment of other authentication procedures in the front end and API”.17 In order to prevent the reoccurrence of the incident, Equicom indicated in its Initial Report “tighter security measures in the internet banking facility.”18

Equicom also declared in its Initial Report that it will only conduct actions to inform the affected data subjects once a complaint is received, and that there is an “[o]ngoing thorough investigation.”19

Equicom is then requesting the postponement of notification of the affected data subjects. It stated that the reason for the request is “currently undergoing evaluation”.20

Discussion

The Commission resolves to deny the request for postponement of notification of data subjects.

I. The incident falls within the scope of the mandatory breach notification requirements.

The Commission finds that the case falls under the mandatory breach notification requirement and notification of the affected data subjects is necessary in order to protect them from the risk of serious harm. As

provided in Rule V, Section 11 of NPC Circular No. 16-03 (Personal Data Breach Management):

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. x x x

B. There is reason to believe that the information may have been acquired by an unauthorized person; and,

C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.21

(Emphasis Supplied)

Based on the records, all the conditions for mandatory breach notification are present.

The account numbers involved are considered as information that may be used to enable identity fraud since it relates to financial information of the data subjects.22 Further, Equicom itself admitted in its Initial Report that the use of depositors’ account number may enable identity fraud.23

Additionally, Equicom stated that there was indeed unauthorized debit on Delictable Inc.’s account including fund transfers via Instapay and three (3) transactions amounting to one hundred fifty thousand pesos (Php 150,000) was transferred via GCash.24 In this case, it is thus evident that the account numbers of the depositors have been acquired by an unauthorized person.

Consequently, the unauthorized acquisition will give rise to a real risk of serious harm to the nineteen (19) clients of Equicom whose bank accounts are compromised. Moreover, based on the DBNMS Report submitted, the total amount subject of the unauthorized transfer of funds is Php 3,077,456.00.25

Equicom stated that it will only conduct actions to inform the affected data subjects once a complaint is received.26

This Commission reiterates Equicom’s obligations as the Personal Information Controller (PIC) to notify the affected data subjects in cases of breach that fall under the mandatory notification rule. Also, Equicom should have taken into account the likelihood of harm or negative consequences of the incident given the fact that the account numbers were already acquired by an unauthorized person.

This Commission stresses that Equicom need not wait for a complaint before notifying the affected data subjects, especially in this case, where harm had already materialized through the unauthorized acquisition of account numbers. Further, there’s still a continuing risk of serious harm posed to other data subjects given that Equicom has yet to notify its data subjects.

This Commission finds that the notification to the affected data subjects is necessary in order to allow them to take the necessary precautions or other measures to protect themselves against the possible effects of the breach.27 Equicom must notify the data subjects affected by the hacking incident of their bank accounts to reduce the risks arising from the breach and to prevent further unauthorized fund transfers from their bank accounts.28

II. The postponement of notification is not warranted by mere “investigation.”

Equicom’s justification for postponement is anchored on its claim that the breach is “currently undergoing investigation.”29 However, the Commission is not persuaded by the justification.

Rule V, Section 18(B) of NPC Circular No. 16-03 provides that the Commission “may authorize the postponement of notification if such notification may hinder the progress of a criminal investigation related to a serious breach, taking into account circumstances provided in Section 13 of this Circular, and other risks posed by the personal data breach.”30 (Emphasis supplied)

Here, Equicom has not provided enough proof to show that there is an ongoing criminal investigation. The mere mention that it is “currently undergoing investigation”31 does not suffice. Thus, the Commission cannot grant its request to postpone the notification to the nineteen (19) clients whose bank accounts are subject to unauthorized fund transfers.

III. Equicom as a PIC must submit its Full Breach Report

In its initial report, Equicom stated that it undertook measures to address the breach including correctional actions, remediation, and preventive steps that would mitigate and remediate the incident.32

However, Equicom has yet to submit its Full Breach Report which includes the description of the personal data breach, actions and decisions of the incident response team, outcome of the breach management, and difficulties encountered and compliance with notification requirements.33 Moreover, in this case, the Commission finds it necessary for Equicom to submit the proof of security measures it undertook to address the breach as stated in its initial report.

WHEREFORE, premises considered, the Commission resolves that the request to postpone the notification of the affected data subjects filed by Equicom Savings Bank (Equicom) is hereby DENIED.

Equicom is hereby ORDERED, within fifteen (15) days from receipt of this Resolution, to comply with the following:

  1. NOTIFY the affected data subjects, pursuant to Section 18 of the NPC Circular No. 16-03, and submit proof of compliance thereof, including the proof of receipt of the data subjects of such notification;

  2. SUBMIT a Full Breach Report pursuant to Sections 17(D) in relation to Section 9 of NPC Circular No. 16-03; and

  3. SUBMIT proof of security measures.

SO ORDERED.

City of Pasay, Philippines. 14 July 2022.

JOHN HENRY D. NAGA Privacy Commissioner

WE CONCUR:

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

DUG CHRISTOPHER B. MAH Deputy Privacy Commissioner

Copy furnished:

JTF Data Protection Officer Equicom Savings Bank

COMPLIANCE AND MONITORING DIVISION ENFORCEMENT DIVISION GENERAL RECORDS UNIT National Privacy Commission

Footnotes

  1. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Date of Notification of Equicom Savings Bank (01 July 2022). ↩

  2. Id., 1.b Chronology of Equicom Savings Bank. ↩

  3. Id. ↩

  4. Id. ↩

  5. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Equicom Savings Bank (01 July 2022). ↩

  6. Id. ↩

  7. Id. ↩

  8. Id. ↩

  9. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.b Chronology of Equicom Savings Bank (01 July 2022). ↩

  10. Id., 1.a How breach occurred + DPS vulnerability. ↩

  11. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Brief Summary of Equicom Savings Bank (01 July 2022). ↩

  12. Id., 2.b Other info that may enable identity fraud. ↩

  13. Id., 2.a SPI. ↩

  14. Id., 1.c Number of DS / Records. ↩

  15. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 3.a Measures to address the breach of Equicom Savings Bank (01 July 2022). ↩

  16. Id., 3.b. Measures to secure/recover personal data ↩

  17. Id., 3.c. Actions to mitigate harm ↩

  18. Id., 3.e Measures to prevent recurrence of incidence ↩

  19. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 3.d Actions to inform data subjects of Equicom Savings Bank (01 July 2022). ↩

  20. Id. Type of Request. ↩

  21. NPC Circular No. 16-03, Rule V, § 11. ↩

  22. Id. ↩

  23. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 2.b Other info that may enable identity fraud (01 July 2022). ↩

  24. Id. 1.b. Chronology ↩

  25. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), 1.c Number of DS / Records of Equicom Savings Bank (01 July 2022). ↩

  26. Id. 3.d Actions to inform data subjects ↩

  27. NPC Circular No. 16-03, Rule V, § 18(A). ↩

  28. NPC Circular No. 16-03, Rule V, § 18(B). ↩

  29. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Justification for postponement of Equicom Savings Bank (01 July 2022). ↩

  30. NPC Circular No. 16-03, Rule V, § 18(B). ↩

  31. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), Justification for postponement of Equicom Savings Bank (01 July 2022). ↩

  32. In re: Equicom Savings Bank, NPC BN 22-094, Preliminary Breach Notification Form, Data Breach Notification Management System (DBNMS), ¶¶ of Equicom Savings Bank (01 July 2022). ↩

  33. NPC Circular 16-03, Rule IV, § 9. ↩

Backlinks

  • No backlinks found