NPC Issuance Wiki

NPC BN 18-117: In re: UM

Issued Resolution

Source

Source Tags

  • Personal-data-breach
  • Breach-notification-NPC Circular 16-03
  • Section-11-when-notification-required
  • Section-17-72-hour-notfication
  • Section-20-security-of-personal-information
  • Email-addresses-names- personal-information-Identity-fraud-risk-phising
  • Unauthorized-access- suspected
  • Third-party-services-provider-google
  • University-personal Informatio-controller
  • Post-breach-report-compliance
  • Data-subject-notification-home-page-announcement
  • Alternative-notification-equally-effective

Resolution Text

IN RE: UM

x---------------------------------------------------------------x

RESOLUTION

DE JESUS, D.P.C.:

Before the Commission is the Compliance submitted by the University of Mindanao (UM) to the Order of the Commission dated 20 September 2021.1

Facts

In its Breach Notification Report dated 06 July 2018, UM notified the Commission that on 04 July 2018, at around 5:00 o’clock in the afternoon, the University’s Management Information System (MIS) Manager discovered that there were one hundred fifty-three (153) emails sent to unknown email addresses through their UM MIS official email address.2

UM shared that on the same date, its Information and Communication Technology Center (ICTC) was informed about the breach.3 UM further shared that its “MIS Manager and ICTC found out that those emails were assumingly “Russian” email addresses.”4

UM alleged that the incident was due to the vulnerabilities of their third-party service provider – “Google”.5 Additionally, UM claims that its ICTC Technical team has no control over Google’s security measures.6

According to UM, its MIS Manager immediately informed its Data Protection Officer (DPO) through its ICTC about the incident and the possibility “that personal data (limited to email addresses and names only) of more or less [one thousand six hundred fifty (1,650)] registered employees of the university was infiltrated.”7

On 08 October 2018, the Commission, through its Complaints and Investigation Division (CID), invited UM for a meeting to discuss the above-mentioned incident.8 On the part of UM, its DPO ECT attended said meeting.9

During the meeting, the Commission required UM to submit supplementary evidence in relation to its breach notification.10 As such, on 30 October 2018, UM sent, via email, the following Supplemental Requirements in compliance with this directive:

  1. PDF file format of ANNEX C - Mandatory Notification: Personal Data Breach Notification for the National Privacy Commission,

  2. PDF file format of their SSL/HTTPS renewal receipt provided by GoDaddy.com,LLC.,

  3. PDF file format of their IT Security Policy, and

  4. PNG image file format of their UM MIS HOME PAGE ANNOUNCEMENTS to all data subjects.11

On 22 June 2021, the Commission, through its CID, issued an Order, requiring UM to submit its Post-Breach Report within ten (10) days from receipt thereof.12 In the Order, UM was further required to submit the proper documentation on the following:

  1. Description of the personal data breach, its root cause and circumstances regarding its discovery;

  2. Actions and decisions of the incident response team;

  3. Outcome of the breach management and difficulties encountered, and

  4. Compliance with notification requirements and assistance provided to affected data subjects.13

On 02 September 2021, UM submitted its compliance with the above Order through an email containing a PDF file format of its report and a scanned copy of its registry receipt dated 02 September 2021.14

In its Post-Breach Report, UM averred that:

“[the] incident was caused by exposed user accounts, which is probably a data breach on the side of Google Email service provider, which the University of Mindanao is currently subscribed to host its “@umindanao.edu.ph” email addresses. The exact cause of the breach cannot be conclusively [pinpointed] unless [G]oogle would provide their own service log file. However, due to [the] number of its users[,] said service provider is very much prone to hacking.”15

According to UM, upon discovery of the incident, its MIS Manager, KMS, immediately emailed16 its representative to Google, RV. RV acknowledged receipt thereof17 and reported the matter to Google.18

UM clarified in its Post-Breach Report that while it initially believed that the incident affected one thousand six hundred fifty (1,650) data subjects corresponding to the number of individuals included in the MIS official emails, after investigation, it was discovered that only one hundred fifty-three (153) emails were actually affected by the breach.19

In the same report, UM also explained that it did not perform an analysis of of the malicious emails “because the spammed emails [contain] only random characters that [are] incomprehensible.”20

Furthermore, UM claimed that it was not able to do further analysis because it has no access to Google’s email server.21 However, UM reported that after the incident, it immediately retrieved the log files from the MIS servers and cross-referenced them to the Internet Protocol (IP) addresses that accessed their database within the same time frame when the breach occurred.22 To prevent further unauthorized access, UM reported that Foreign IP addresses originating from Russia were immediately added to its list of blocked IP addresses.23

Further, UM claimed that “there was no indication that the MIS database server was compromised because the data breach happened on the server of Google Mail – a third-party service provider completely independent from the UM MIS server.”24 UM clarified that its old MIS database server is no longer in use since the MIS has already migrated to a new database server.25

UM also reported that it checked the “sent items” of their official email addresses and found out that “there is no email sent to any of the registered email addresses of employees.”26 According to UM, its MIS Manager and ICTC Technical team also checked its MIS database and data servers for possible breaches or infiltration.27 However, none was noted.28 UM also narrated that it “archived all malicious emails for analysis, reporting, and evidence purposes.”29

Further, UM claims that it immediately notified all data subjects by posting an announcement on its “HOME PAGE”30 to alert them about possible receipt of malicious emails and provide instructions to refrain from opening and immediately deleting any malicious emails.31 To further substantiate its claims that it notified the data subjects, UM attached the list of employees who have seen the announcement on the MIS website.32

UM further averred that its MIS manager added a stronger security feature by using a two (2) step verification login in its database33 and security questions to ensure its security and integrity.34 UM’s “ICTC guaranteed that all systems and browsers within the school premises are safe and secured with the SSL/HTTPS certificates and SOPHOs security appliance/firewall protection.”35

Lastly, according to UM, its MIS system was “restored and available within the same date after assuring that the integrity of the database and data servers was not compromised.”36 UM reported that from 04 July 2018 up until the date of submission of its compliance, there are “no complaints from the data subjects of the same nature [and/or] incident related to the reported notification.”37

On 14 September 2021, the Commission, through an email, requested UM to clarify and submit the following documents in relation to its 02 September 2021 submission for proper evaluation:

  1. Proof of blocking the foreign I.P. address related to the incident;

  2. Proof/Certification that the MIS database and the database server were not compromised and that no breach or infiltration resulted from the incident;

  3. Proof of nonuse of the old MIS data server;

  4. Proof of migration to the new database server;

  5. Proof that no complains was filed related to the incident;

  6. Certification from the UM ICTC which guaranteed that all systems and browsers within the school premises are safe and secured; and

  7. Proof that the SSL/HTTPS certificated and SOPHOS security appliance/firewall protection are up-to-date.38

Subsequently, on 20 September 2021, UM submitted its compliance39 along with the following attachments:

  1. Screenshots showing that it blocked the foreign IP addresses related to the incident;40

  2. A scanned copy of a certification issued by the University’s AVP-ICTC stating that the MIS database and its servers were not compromised and that no breach or infiltration resulted from the incident;41

  3. A scanned copy of a certification issued by the University’s AVP-ICTC stating that the old MIS database server is no longer in use;42

  4. A scanned copy of the Delivery Receipt of the University’s new database server;43

  5. A screenshot showing its proof of Installation of new database server;44

  6. A screenshot showing its proof of migration from the old MIS database server to the new MIS database server;45

  7. A scanned copy of the Certificate of No Complaint issued by the University’s VP-HRMD;46

  8. A scanned copy of a certification issued by the University’s AVP-ICTC stating that all systems and browsers within the University’s premises are safe and secured;47 and

  9. Screenshots showing that the University’s SSL/HTTPS certificates and SOPHOS security appliance/firewall protection are up-to-date.48

UM prayed for the said submission to be considered as sufficient compliance with the Commission’s Orders dated 22 June 2021 and email dated 14 September 2021.49

Issue

Whether UM has sufficiently complied with the Commission’s Order Order dated 22 June 2021 and email dated 14 September 2021.

Discussion

The Commission notes the Compliances made by UM dated 02 September 2021 and 20 September 2021 in relation to the Order dated 22 June 2021 and email dated 14 September 2021 and hereby resolves to close the matter.

Section 11 of NPC Circular No. 16-03 (Personal Data Breach Management) provides the conditions when notification is mandatory, to wit:

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

  • A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud.

For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

  • B. There is reason to believe that the information may have been acquired by an unauthorized person; and

  • C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.50 (Emphasis supplied)

For the first requisite, UM stated in its Post-Breach Report that its MIS Manager discovered that there were one hundred fifty-three (153) emails containing Russian phrases sent to unknown recipients using different “@umindanao.edu.ph” email addresses.51

It follows, therefore, that the email addresses and names of its users were obtained by the perpetrator in order to access UM MIS official email addresses and send out those emails to unknown email addresses.

Verily, the data subject’s UM MIS official email addresses, including its contents, fall under “other information” within the contemplation of Section 11(a). Since the first requisite need not necessarily involve sensitive personal information as it may cover other information which, under the circumstances, may enable identity fraud, the Commission finds the first requisite present in this case.

For the second requisite, which requires that there is reason to believe that the information may have been acquired by an unauthorized person, UM, in its Report, further stated that:

This incident was caused by exposed user accounts, which is probably a data breach on the side of the Google Email service provider, which the University of Mindanao is currently subscribed to host its @umindanao.edu.ph email addresses.52

While it may seem from the foregoing that the point where the incident happened is yet unverified, one thing is certain, there was a breach where the email addresses and names of its users were acquired by an unauthorized person, who thereafter used such data to access the UM MIS official email addresses.53 To the Commission, this is sufficient reason to believe that the second requisite is also present in this case.

Lastly, the third requisite requires the personal information controller or the Commission to believe that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.

In determining whether the unauthorized acquisition is likely to give rise to a real risk of serious harm, a PIC or the Commission may consider several factors such as the nature of the information involved, the amount of the information of the data subject, and the number of affected data subjects, among others.54

At this point, it is noteworthy to state that the Commission has previously ruled that:

This Commission takes this opportunity to stress that information that may be used to enable identity fraud under Section 11 (A) is not limited to the categories of information listed therein, such as data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

Contrary to Respondent’s claim, names and e-mail addresses are information that may be used to enable identity fraud. An e-mail address is considered personal information and an unauthorized acquisition thereof could easily trace the identity of the data subject through the conduct of “Phishing” attacks to obtain more information about the user which would then be used to access important accounts resulting to identity theft and financial loss.55 (Emphasis supplied)

In this case, UM reported that:

Initially, the incident was thought of to have affected 1,650 data subjects, being the number of those who were part of the MIS official emails, however, it was discovered that only 153 emails were really affected.56

Considering that the breach, in this case, involves “email addresses and names of registered employees”,57 which may enable another person to commit identity fraud such as illegal use of email addresses, and avail privileges only granted to specific MIS users (i.e. access to online libraries and databases), in relation to the substantial number of affected data subjects, there is a real risk of serious harm to the affected data subjects.

Therefore, having identified that all the conditions provided in Section 11 of NPC Circular No. 16-03 are present, notification of the affected data subjects in this case is clearly mandatory.

As to the form and contents of the notification, Section 18 of NPC Circular No. 16-03 is instructive:

  • C. Content of Notification. The notification shall include, but not limited to:

  1. nature of the breach;

  2. personal data possibly involved;

  3. measures taken to address the breach;

  4. measures taken to reduce the harm or negative consequences of the breach;

  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and

  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.

  • D. Form. Notification of affected data subjects shall be done individually, using secure means of communication, whether written or electronic. The personal information controller shall take the necessary steps to ensure the proper identity of the data subject being notified, and to safeguard against further unnecessary disclosure of personal data.

The personal information controller shall establish all reasonable mechanisms to ensure that all affected data subjects are made aware of the breach: Provided, that where individual notification is not possible or would require a disproportionate effort, the personal information controller may seek the approval of the Commission to use alternate means of notification, such as through public communication or any similar measure through which the data subjects are informed in an equally effective manner: Provided further, that the personal information controller shall establish means through which the data subjects can exercise their rights and obtain more detailed information relating to the breach.58

(Emphasis supplied)

In this case, the Commission further takes notice of UM’s submission of a screenshot of its MIS home page announcements which can be viewed by all of its users.59 The announcement posted a sample photo of the Russian email along with a quote that reads:

UNAUTHORIZED EMAIL FROM UM MIS

MIS users who happens to receive emails from xxx@xxx.edu.ph containing malicious content or of foreign origin (Russian) as shown below, kindly report such incident to MIS Manager (call 082 xxxxx) and immediately delete such email. DO NOT ATTEMPT to open, view, or click any links in the received email. YOU ARE ADVISED to regularly change your email ad password.

In addition, thereto, UM also attached to its Post-Breach Report a screenshot of the list of employees who logged in on 06 July 2018 onwards who have seen the announcement on the MIS website60 to substantiate its claim that the affected data subjects were duly notified.

Upon examining the submitted list,61 it is evident that page 1 of 1,382 reveals thirty (30) distinct log-ins made by various users. To the Commission, such posting in MIS home page announcements of the above quote with a sample photo is sufficient to notify all users of the breach incident.

Section 20(a) of the Data Privacy Act of 2012 mandates:

“Sec. 20. Security of Personal Information. – x x x

(a) ” The personal information controller must implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration, and disclosure, as well as against any other unlawful processing. x x x”62 (Emphasis supplied)

Notably, in its Post-Breach Report, UM reported to the Commission not only its actions taken to notify the affected data subjects about the breach incident but also reasonable and appropriate measures it implemented to mitigate and avoid its future recurrence.63

As a mitigating measure, UM immediately reported the incident to its service provider – Google.64 UM also scanned the UM MIS database and data servers, including the “sent items” of their official email addresses, for possible breach or infiltration and blocked all the foreign IP addresses originating from Russia.65

UM also submitted a Certification from its MIS Manager affirming the integrity and security of the MIS database and its server.66 Even though UM submitted to the Commission a Certification of No Complaint67 stating that there has been no compromise, breach, or infiltration due to the incident, UM still purchased, installed, and migrated to a new database server to prevent future similar attacks.68

Further, UM submitted to the satisfaction of the Commission proof that UM’s SSL/HTTPS certificates as issued to xxx.edu.ph, issued by R3,69 and SOPHOS security appliance/firewall protection are up-to-date.70

Lastly, UM has sufficiently complied with the notification requirement under Section 17 of NPC Circular No. 16-03 which states:

SECTION 17. Notification of the Commission. The personal information controller shall notify the Commission of a personal data breach subject to the following procedures:

  • A. When Notification Should be Done. The Commission shall be notified within seventy-two (72) hours upon knowledge of or the reasonable belief by the personal information controller or personal information processor that a personal data breach has occurred.71

Here, UM discovered the breach on 04 July 2018 at around 5:00 o’clock in the afternoon,72 and the Commission was notified through email on 06 July 2018 at 2:00 o’clock in the afternoon.73

This indicates that UM notified the Commission within approximately 57 hours from discovery, which is well within the prescribed seventy-two (72) hour period. Therefore, UM has timely notified the Commission of such breach.

Apart from having implemented reasonable and appropriate organizational and security measures discussed above, the Commission also finds UM to have sufficiently notified its data subjects, pursuant to NPC Circular No. 16-03, by posting a public announcement on its home page74 and providing its users a direct instruction to refrain from opening and to immediately delete any malicious emails.75

WHEREFORE, premises considered, the Commission resolves that the matter of NPC BN 18-117 “In re: UM” is hereby CLOSED.

SO ORDERED.

City of Pasay, Philippines.

13 November 2023.

NERISSA N. DE JESUS
Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA
Privacy Commissioner

LEANDRO ANGELO Y. AGUIRRE
Deputy Privacy Commissioner

Copy furnished:

PMN

Data Protection Officer

COMPLAINTS AND INVESTIGATION DIVISION

ENFORCEMENT DIVISION

GENERAL RECORDS UNIT

National Privacy Commission

Footnotes

Footnotes

  1. In Re: University of Mindanao, NPC BN 18-117, Compliance to Order dated 20 September 2021. ↩

  2. Mandatory Notification: Personal Data Breach Notification for the National Privacy Commission dated 06 July 2018. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. In Re: UM, NPC BN 18-117, Meeting Invite dated 08 October 2018. ↩

  9. In Re: UM, NPC BN 18-117, Attendance sheet for Discovery Conference dated 16 October 2018. ↩

  10. In Re: UM, NPC BN 18-117, Supplementary Requirements – Data Breach Notification, sent via Email on 30 October 2018. ↩

  11. Id. ↩

  12. In Re: UM, NPC BN 18-117, Order dated 22 June 2021. ↩

  13. Id. ↩

  14. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021. ↩

  15. Id. ↩

  16. Id., Annex “A” – Email of KMS to RV. ↩

  17. Id., Annex “B” – Email of RV Acknowledging the Report; see also Annex “G” – Email of Mr. RV of the Breach Report to Google. ↩

  18. Id. ↩

  19. Id. ↩

  20. Id. ↩

  21. Id. ↩

  22. Id. ↩

  23. Id. ↩

  24. Id. ↩

  25. Id. ↩

  26. Id. ↩

  27. Id. ↩

  28. Id. ↩

  29. Id. ↩

  30. Id., Annex “F” – Announcement to Refrain from Opening and to Delete Malicious Emails. ↩

  31. Id. ↩

  32. Id., Annex “I” – List of Employees who have Received and Seen the Announcement and Notification. ↩

  33. Id., Annex “E” – A Screenshot of the 2-step Verification System. ↩

  34. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021. ↩

  35. Id. ↩

  36. Id. ↩

  37. Id. ↩

  38. In Re: UM, NPC BN 18-117, email from the Complaints and Investigation Division dated 14 September 2021. ↩

  39. In Re: UM, NPC BN 18-117, Compliance dated 20 September 2021. ↩

  40. Id., Annexes “A” and “A-1”. ↩

  41. Id., Annex “B”. ↩

  42. Id., Annex “C”. ↩

  43. Id., Annex “D”. ↩

  44. Id., Annex “D-1”. ↩

  45. Id., Annex “D-2”. ↩

  46. Id., Annex “E”. ↩

  47. Id., Annex “F”. ↩

  48. Id., Annexes “G” and “G-1”. ↩

  49. Id. ↩

  50. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 11. ↩

  51. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021. ↩

  52. Id. ↩

  53. In Re: UM, NPC BN 18-117, Compliance to Order dated 20 September 2021. Mandatory Notification: Personal Data Breach Notification for the National Privacy Commission dated 06 July 2018. ↩

  54. NPC BN 17-028 and NPC BN 18-180, p. 8. ↩

  55. NPC BN 20-124, Resolution dated 10 September 2020, p. 3. ↩

  56. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021. ↩

  57. Mandatory Notification: Personal Data Breach Notification for the National Privacy Commission dated 06 July 2018. ↩

  58. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 11. ↩

  59. In Re: UM, NPC BN 18-117, Supplementary Requirements – Data Breach Notification, sent via Email on 30 October 2018. ↩

  60. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021, Annex “I” – List of Employees who have Received and Seen the Announcement and Notification. ↩

  61. Id. ↩

  62. Data Privacy Act of 2012, Section 20(b). ↩

  63. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021. ↩

  64. Id. ↩

  65. Id. ↩

  66. Id. ↩

  67. Id. ↩

  68. Id. ↩

  69. In Re: UM, NPC BN 18-117, Compliance dated 20 September 2021, Annex “G” ↩

  70. Id., Annex “G-1”. ↩

  71. National Privacy Commission, Personal Data Breach Management, NPC Circular No. 16-03, rule V, § 17. ↩

  72. Mandatory Notification: Personal Data Breach Notification for the National Privacy Commission dated 06 July 2018. ↩

  73. Id. ↩

  74. In Re: UM, NPC BN 18-117, Post Breach Report dated 02 September 2021, Annex “F” – Announcement to Refrain from Opening and to Delete Malicious Emails. See also Annex “I” – List of Employees who have Received and Seen the Announcement and Notification. ↩

  75. In Re: UM, NPC BN 18-117, Compliance dated 20 September 2021. ↩

Backlinks

  • No backlinks found