NPC Issuance Wiki

NPC BN 18-073: In re: Philippine Long Distance Telephone Company, Inc.

Issued Resolution

Resolution Text

IN RE: PHILIPPINE LONG DISTANCE TELEPHONE COMPANY, INC.

x----------------------------------------------------x

AGUIRRE, D.P.C.:

Before the Commission is Philippine Long Distance Telephone Company, Inc.’s (PLDT) Compliance dated 21 July 2022 following the directives to submit a Post-Breach Report and proof of notification to its affected data subjects.1

Facts

On 18 May 2018, PLDT notified the Commission of a breach.2 It narrated that on 15 May 2018, its employees reported having received emails from PLDT’s own Email Dispatch System.3 PLDT uses its Email Dispatch System to send service communications e-mail to its customers.4

The reported emails contained two (2) marketing campaigns entitled “What is trending in Philippines?” and “Get this birthday card.”5

PLDT stated that its Cyber Defense Team conducted an initial investigation which showed that the web application portal of its Email Dispatch System has been compromised by exploiting a vulnerability in its bypass authentication.6 It explained that the perpetrator used the existing contact list in the Email Dispatch System to send the unauthorized e-mails containing the marketing campaigns.7

PLDT added that its initial assessment suggests that around five hundred eighty-four thousand seven hundred ninety-three (584,793) email addresses of individual data subjects may have been involved in the incident.8

PLDT also claimed that it immediately halted the operations of the Email Dispatch System and took down its web application upon its discovery of the breach.9 PLDT added that access to the system was made limited through the corporate network and was only kept active for purposes of the investigation.10

On 01 July 2022, the Commission, through its Complaints and Investigation Division (CID), issued an Order requiring PLDT to submit a Post-Breach Report detailing the incident that prompted the notification to the Commission:11

Thus, pursuant to Section 9, Rule IV of the National Privacy Commission Circular No. 16-03 on Personal Data Breach Management, Philippine Long Distance Telephone Company, Inc., is hereby required to submit a Post Breach Report detailing the incident that prompted the notification to the Commission;

A. Description of the personal data breach, its root cause and circumstances regarding its discovery;

B. Actions and decisions of the incident response team; Provide a copy of the forensic investigation report conducted by the PLDT Cyber Defense Team

C. Measures conducted to address the incident and prevent its recurrence; and

D. Compliance with notification requirements and assistance provided to affected data subjects, and proofs thereof, if applicable.

The PHILIPPINE LONG DISTANCE TELEPHONE COMPANY, INC., is hereby given a period of fifteen (15) days from receipt hereof to submit its compliance through email at complaints@privacy.gov.ph.12

PLDT submitted a Post-Breach Report on 21 July 2022.13 It reiterated the information in its initial report regarding the circumstances surrounding the breach and its discovery.14

Further, PLDT maintained that it escalated the incident to its Cyber Security Operations Group (CSOG) for investigation and remediation on the same day it discovered the breach.15

PLDT claimed that its investigation revealed that the emails subject of the breach did not contain any malicious malware.16 It also claimed that no other personal information of PLDT customers was involved in the breach aside from the email addresses in the Email Dispatch System.17 Further, it maintained that the design of the Email Dispatch System disabled any exfiltration of data outside of the PLDT environment. Thus, PLDT concluded that the email database of the system had not been downloaded nor acquired by the perpetrator of the breach.18

In addition, PLDT reported that it has already discontinued the use of the Email Dispatch System after the incident as a measure to address the incident and prevent its recurrence.19

Lastly, PLDT maintained that its “Deputy Data Privacy Officer [already] wrote to the affected data subjects to explain to them what happened, what personal information was involved, what PLDT has done to prevent damage from this incident as well as the recurrence of the breach, and what the affected data subjects can do if they received the suspicious email.”20 PLDT attached a copy of the email notification sent to its affected data subjects.21

PLDT also prepared an email on “Frequently Asked Questions and Suggested Answers for Spam Email Received Incident”22 and an advisory on handling guidelines for spam emails received by PLDT Home customers.23 PLDT attached a copy of the email with a sample image of the unauthorized email and other details of the incident.24

Issue

Whether PLDT notified its data subjects and sufficiently addressed the breach and implemented measures to prevent its recurrence.

Discussion

The Commission resolves to close the matter. PLDT’s submissions show that it notified its affected data subjects, sufficiently addressed the breach, and implemented measures to prevent its recurrence.

It is the obligation of a Personal Information Controller (PIC), such as PLDT, to notify its affected data subjects of a breach.25 Section 18 (C) of NPC Circular 16-03 (Personal Data Breach Management) provides the information required in notifying the affected data subjects:

Section 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

…

C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;
  2. personal data possibly involved;
  3. measures taken to address the breach;
  4. measures taken to reduce the harm or negative consequences of the breach;
  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and
  6. any assistance to be provided to the affected data subjects.26

In this case, a copy of the notification sent by PLDT to its affected data subjects show that it complied with the required contents for the notification under Section 18 (C) of NPC Circular 16-03.27

In its email notification, PLDT informed the data subjects of the incident involving the data subjects’ registered email addresses.28 PLDT narrated that an external user, who is not in any way authorized by PLDT, sent the emails using the email admin@pldthome.com to the registered email address of its customers.29

PLDT further assured the data subjects that “there has been no unauthorized downloading or access to [their] personal customer information in [PLDT’s] records. [Its] system configuration does not allow porting out of data. Also, the spam emails did not contain any malicious codes and/or links to malicious commands or controls that will let any external user get further data from [its] system.”30

Following the information regarding the breach and the personal data involved in the breach, PLDT stated that it has turned off all access and operations of its email campaign facility.31

PLDT also provided the contact information of its Deputy Data Privacy Officer to whom further questions or concerns may be addressed.32

Apart from the email notification, PLDT provided additional assistance to the affected data subjects by providing as well an advisory on handling guidelines for spam emails received by PLDT Home customers.33

Further, PLDT sufficiently addressed the breach and prevented its recurrence. PLDT’s immediate investigation of the incident revealed that the breach was caused by exploiting a vulnerability in the bypass authentication of its Email Dispatch System.34

PLDT determined that the suspicious e-mails did not contain any malware. While a vulnerability may have been exploited and there was access to their customers’ e-mail addresses, the design of PLDT’s system disabled and prevented any exfiltration of data outside of its environment.35

Thus, PLDT’s investigation concluded that only email addresses, and no other personal information of PLDT customers, were involved in the breach,36 and that no exfiltration of the email database may have been possible.37 As such, the immediate taking down of the system sufficiently addressed the breach since it prevented further access and use of the registered email addresses to send more unauthorized emails and the possibility of exfiltrating other personal information of PLDT’s data subjects.

Considering that the breach was due to a vulnerability in the bypass authentication of the Email Dispatch System, PLDT’s immediate discontinued use prevents the recurrence of the incident.

Given the foregoing, the Commission finds that the measures undertaken by PLDT has sufficiently addressed the incident and prevents its recurrence.

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-073 In re: Philippine Long Distance Telephone Company, Inc. is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines. 16 March 2023

LEANDRO ANGELO Y. AGUIRRE Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA Privacy Commissioner

NERISSA N. DE JESUS Deputy Privacy Commissioner

Copy furnished:

LBJ Data Privacy Officer

Philippine Long Distance Telephone Company, Inc.

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

Footnotes

  1. Compliance of PLDT to Order dated 01 July 2022, 21 July 2022, at 1, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  2. Notification Letter to the Commission, 18 May 2018, at 1, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2018). ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Notification Letter to the Commission, 18 May 2018, at 2, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2018). ↩

  9. Id. ↩

  10. Id. ↩

  11. Order, 01 July 2022, at 1, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  12. Order, 01 July 2022, at 1-2, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  13. Post-Breach Report, 21 July 2022, at 1, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  14. Id. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. at 2. ↩

  18. Id. ↩

  19. Post-Breach Report, 21 July 2022, at 2, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  20. Id. ↩

  21. Id. Annex B. ↩

  22. Id. at 2. ↩

  23. Id. ↩

  24. Id. Annex A. ↩

  25. National Privacy Commission, Personal Data Breach Management, Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], § 18 (A) (15 December 2016). ↩

  26. Id. § 18 (C). ↩

  27. Post-Breach Report, 21 July 2022, Annex B, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  28. Id. ↩

  29. Id. ↩

  30. Id. ↩

  31. Id. ↩

  32. Id. ↩

  33. Post-Breach Report, 21 July 2022, at 2, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  34. Notification Letter to the Commission, 18 May 2018, at 1, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2018). ↩

  35. Post-Breach Report, 21 July 2022, at 2, in In re: Philippine Long Distance Telephone Company, Inc., NPC BN 18-073 (NPC 2022). ↩

  36. Id. ↩

  37. Id. ↩

Backlinks

  • No backlinks found