NPC Issuance Wiki

NPC BN 18-094: In re: Orica Australia Pty. Ltd.

Issued Resolution

Source

Source Tags

  • Data Breach, Mandatory Breach Notification, Breach Management, Personal Breach Management (NPC Circular 16-03)

Resolution Text

IN RE: ORICA AUSTRALIA PTY. LTD.

x----------------------------------------------------x

RESOLUTION

BELARMINO, D.P.C.;

Before the Commission En Banc (Commission) is the breach notification dated 18 June 2018 and the breach management of Orica Australia Pty Ltd. (Orica), in compliance with NPC 16-03 (Personal Breach Management).

FACTS

Orica is a mining and infrastructure solutions provider engaged in the production and supply of explosives, blasting systems, specialty mining chemicals and related products.1

On 18 June 2018, Orica reported to the National Privacy Commission (NPC), a possible data breach after receiving an email from PageUp, a cloud hosted system used by Orica for online employee recruitment through its Australian website.2 PageUp informed Orica that it had detected unauthorized activity within its system in or around 23 May 2018.3 According to Orica, PageUp indicated that the suspected cause of the incident was a malware-initiated intrusion.4 Orica likewise states that on 12 June 2018, PageUp issued a public statement declaring:

We believe certain personal data relating to our clients, placement agencies, applicants, references, and our employees has been accessed. While the investigation continues, we are confident that the most critical data categories were not impacted, including resumes, financial information, employee performance reports, Australian tax file numbers and employment contracts.5

Orica further asserts that there is no technical integration between the PageUp system and Orica’s internal systems that would pose an ongoing security risk to the personal data held by Orica.6

Orica also reports that, based on the optional address and nationality fields within the PageUp system, approximately four thousand six hundred and forty three (4,643) individuals who are either Philippine citizens or have resided in the Philippines may have used the PageUp system to apply for employment with Orica or its related entities since 2004.7

Orica states that the primary application fields collected through PageUp include the applicant’s name, email address, telephone number, physical address, nationality and date of birth.8 Applicants may also voluntarily provide additional information such as educational background, employment history, and whether they hold an occupational license.9

Attached to Orica’s notification is an email correspondence from PageUp indicating that the cyber-attack involved advanced methods to gain unauthorized access to its IT systems in Australia, Singapore, and the United Kingdom.10 PageUp also reported that the threat had been contained and eradicated.11

Orica emphasizes that its report to the Commission was made voluntarily and not as a result of a determination by Orica that mandatory breach notification under the Implementing Rules and Regulations (IRR) of the Data Privacy Act (DPA) of 2012 was required.12

On 10 October 2022, the Commission, through its Complaints and Investigation Division (CID) issued an Order directing Orica to submit a Post Breach Report containing: (a) the outcome of the breach management, and difficulties encountered; (b) proof and/or documentation of the measures conducted to address the incident and prevent its recurrence; and (c) proof of compliance with notification requirements and assistance provided to affected data subjects.13

On 25 October 2022, Orica submitted its compliance.14 According to Orica, in November 2018, PageUp publicly released the results of a third-party forensic investigation analyzing all available digital forensic evidence.15 The forensic report indicated that although the attacker successfully installed tools capable of data exfiltration, no specific evidence was found confirming that any data was actually exfiltrated.16

Orica notes that the significant time elapsed since the incident hindered its ability to secure certain details relevant to the Commissioner’s order.17 Nevertheless, Orica submitted the following five (5) annexes:

  1. Joint Statement on the PageUp Limited Data Incident issued by the Office of the Australian Information Commissioner (OAIC), Australian Cyber Security Centre (ACSC) and IDCare. The statement advised potentially affected individuals to: (a) immediately change their passwords; (b) regularly update passwords and ensure they are hard to guess; (c) be wary of phishing emails by reviewing the sender of the email and be cautious of links and attachments; and (d) avoid telephone scammers.18

  2. News report from ITnews for Australian Business, dated 23 November 2018, written by Justin Hendry, stating that an “an independent forensic investigation commissioned by PageUp people has been unable to find evidence that a malware infection led to data being exfiltrated from its systems earlier this year”.

    The report also stated that expert forensic analysts Klein & Co collected and analyzed all available evidence and reached the same conclusion as the Australian Authorities that there was nothing to suggest that any “information may actually have been stolen”.19

  3. Communications broadcast reports issued by PageUp, including sample notification letter sent to affected individuals, updated as of 02 July 2018.20

  4. PageUp System Global Bulletin dated 08 June 2018, informing Orica employees that any information provided on the PageUp platform, including email addresses, names, dates of birth, addresses, and system passwords, may have been accessed. Employees were advised to log into the PageUp system and change their passwords as a precaution.21

  5. PageUp Data Breach Update dated 14 June 2018, signed by Orica’s Chief Digital Officer, providing additional updates to employees and confirming that unauthorized access to PageUp’s systems and personal data relating to clients, job applicants, references and employees had occurred.22

On 16 January 2025, the Commission issued a Minute Resolution directing Orica to submit proof of notification to affected data subjects,23 thus:

WHEREFORE, premises considered, the Commission hereby resolves to:

  1. ORDER Orica Australia Pty. Ltd. to SUBMIT proof of notification to the affected data subjects directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days from receipt of this Minute Resolution; and

  2. DIRECT the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of Orica’s data breach notification and to assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management).24

On 04 March 2025, Orica submitted its Compliance25 attaching:

  1. Samples of primary responses, including email notifications sent on 08 June 201826 and 14 June 201827 to potentially affected Orica employees.

  2. A sample email chain between Orica and an external data subject based in the Philippines, showing both the original notification and Orica’s response.28

  3. Invoices showing that Orica engaged an external service provider, SMS Global, to send text messages notifications to potentially affected data subjects.29

On 08 May 2025, the Commission issued another Minute Resolution again directing Orica to submit proof of notification, stating:

WHEREFORE, premises considered, the Commission hereby resolves to:

  1. ORDER Orica Australia Pty. Ltd. to SUBMIT proof of notification to the affected data subjects or, in the alternative, a sworn affidavit that they have undertaken such matter, directly to the Compliance and Monitoring Division (CMD) within fifteen (15) days from receipt of this Minute Resolution; and

  2. DIRECT the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of Orica Australian Pty. Ltd.’s data breach notification and to assess its breach management pursuant to NPC Circular 16-03 (Personal Data Breach Management). [Emphasis Supplied]30

On 24 June 2025, via electronic email, Orica requested a one-month extension to comply with the above Order.31 Orica argued that an extension was justified on the grounds that: (a) it promptly disclosed the initial breach in 2018; and (b) it had consistently complied with subsequent requests for further information, demonstrating good faith and its reporting obligations seriously.32

On 03 July 2025, the Commission issued a Minute Resolution partially granting Orica’s request:

WHEREFORE, premises considered, the Commission hereby resolves to:

  1. PARTIALLY GRANT the motion of Orica Australia Pty. Ltd. to extend the period to respond to the Minute Resolution dated 08 May 2025;

  2. ORDER Orica Australia Pty. Ltd. to SUBMIT, within a non-extendible period of fifteen (15) calendar days from receipt hereof, proof of notification to the affected data subjects, or in the alternative, a sworn affidavit attesting to such notification, directly to the Compliance and Monitoring Division (CMD) via adjudication@privacy.gov.ph; and

  3. DIRECT the CMD to issue the appropriate orders necessary to evaluate and monitor the completeness of Orica Australian Pty. Ltd.’s data breach notification and to assess its breach management in accordance with NPC Circular 16-03 on Personal Data Breach Management. [Emphasis Supplied]33

On 28 July 2025,34 Orica submitted its compliance, attaching a statutory declaration executed by Orica’s Manager – Cyber Governance, Architecture & Risk, along with the same supporting documents previously submitted.35

ISSUES

  • I. Whether the incident falls under mandatory breach notification under NPC Circular No. 16-03; and

  • II. Whether Orica sufficiently addressed the breach and implemented security measures to prevent its recurrence.

DISCUSSION

The Commission finds that the incident falls under the mandatory breach notification. However, Orica has sufficiently addressed the breach incident pursuant to NPC Circular 16-03 (Personal Data Breach Management).36 As such, the Commission resolves to terminate the investigation and consider the matter closed.

The incident falls under mandatory breach notification.

Section 11 of NPC Circular No. 16-03 provides the conditions when notification is mandatory:

SECTION 11. When notification is required. Notification shall be required upon knowledge of or when there is reasonable belief by the personal information controller or personal information processor that a personal data breach requiring notification has occurred, under the following conditions:

  • A. The personal data involves sensitive personal information or any other information that may be used to enable identity fraud. For this purpose, “other information” shall include, but not be limited to: data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

  • B. There is reason to believe that the information may have been acquired by an unauthorized person; and

  • C. The personal information controller or the Commission believes that the unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.37

Following this, mandatory breach notification to the Commission has the following requisites:

  1. The personal data involves sensitive personal information, or information that may, under the circumstances, be used to enable identity fraud;

  2. There is reason to believe that the information may have been acquired by an unauthorized person; and

  3. The unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject.38

All the foregoing conditions are present in this case.

First, the nature of the information involved are both sensitive personal information and other information that, under the circumstances, may enable identity fraud.

Section 3 (l) of the DPA provides an enumeration of what constitutes sensitive personal information, which reads:

SEC. 3. Definition of Terms. – Whenever used in this Act, the following terms shall have the respective meanings hereafter set forth:

xxx

(l) Sensitive personal information refers to personal information:

  • (1) About an individual’s race, ethnic origin, marital status, age, color, and religious, philosophical or political affiliations;

  • (2) About an individual’s health, education, genetic or sexual life of a person, or to any proceeding for any offense committed or alleged to have been committed by such person, the disposal of such proceedings, or the sentence of any court in such proceedings;

  • (3) Issued by government agencies peculiar to an individual which includes, but not limited to, social security numbers, previous or current health records, licenses or its denials, suspension or revocation, and tax returns; and

  • (4) Specifically established by an executive order or an act of Congress to be kept classified.39

Meanwhile, “information that may, under the circumstances, be used to enable identity fraud” includes, but not limited to data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN; or other similar data, when taken together under the circumstances, be used as the basis of decisions concerning the data subjects, including the grant of rights or benefits.40

In this case, the incident involved personal information of Orica’s employees, such as their names, telephone numbers, email addresses, physical addresses and work experience.41 Aside from these personal information, the dates of birth, which can determine the age of the data subjects, as well as the education and nationality may be deemed sensitive personal information defined under the DPA.42

The Commission previously held that a data subject’s name and email address may be considered under other information that may enable identity fraud.43 The Commission explained:

This Commission takes this opportunity to stress that information that may be used to enable identity fraud under Section 11 (A) is not limited to the categories of information listed therein, such as data about the financial or economic situation of the data subject; usernames, passwords and other login data; biometric data; copies of identification documents, licenses or unique identifiers like Philhealth, SSS, GSIS, TIN number; or other similar information, which may be made the basis of decisions concerning the data subject, including the grant of rights or benefits.

Contrary to Respondent’s claim, names and e-mail addresses are information that may be used to enable identity fraud. An e-mail address is considered personal information and an unauthorized acquisition thereof could easily trace the identity of the data subject through the conduct of “phishing” attacks to obtain more information about the user which would then be used to access important accounts resulting to identity theft and financial loss.44

The second condition, as laid down in Section 11 (B) of NPC Circular 16-03, requires that the personal information controller (PIC) or personal information processor (PIP) must have reason to believe that the information may have been acquired by an unauthorized person.45

In the present case, PageUp, the third-party recruitment system used by Orica, confirmed that unauthorized access to its IT systems occurred and that certain personal data relating to clients, job applicants, references, and employees had been accessed.46 PageUp’s own internal and third-party forensic investigation confirmed the presence of tools capable of data exfiltration, although no conclusive evidence of actual exfiltration was detected.47 Given these circumstances, there exists sufficient basis to reasonably believe that the personal data may have been acquired by an unauthorized person.

Likewise, the third requisite is present. In determining whether the unauthorized acquisition is likely to give rise to a real risk of serious harm, several factors may be considered, such as the nature of the information involved, the amount of the information of data subject, and the number of affected data subjects, among others.48

In this case, the possible unauthorized acquisition is likely to give rise to a real risk of serious harm to any affected data subject, considering that some of the information involved, as explained above, are sensitive personal information and other information that may be used to enable identity fraud.

The unauthorized access to this information can lead to the identification of the data subject through phishing attacks, which are designed to gather additional personal details. Such information may then be used to compromise important accounts, potentially resulting in identity theft and financial loss. The Joint Statement issued by the Australian authorities advising affected individuals to change password, be wary of phishing emails, and remain alert to scams underscores the risk created by the incident.49

Furthermore, Orica reported and has identified that the incident affected approximately four thousand six hundred and forty-three (4,643) individuals who are either Philippine citizens or have resided in the Philippines.50

Therefore, with all conditions under Section 11 of NPC Circular 16-03 being present, notification of the affected data subjects in this case is clearly mandatory.

Orica addressed the breach and implemented reasonable and appropriate security measures to prevent its recurrence.

Section 18 (C) of NPC Circular 16-03 (Personal Data breach Management), to wit:

SECTION 18. Notification of Data Subjects. The personal information controller shall notify the data subjects affected by a personal data breach, subject to the following procedures:

xxx

  • C. Content of Notification. The notification shall include, but not be limited to:

  1. nature of the breach;

  2. personal data possibly involved;

  3. measures taken to address the breach;

  4. measures taken to reduce the harm or negative consequences of the breach;

  5. representative of the personal information controller, including his or her contact details, from whom the data subject can obtain additional information regarding the breach; and

  6. any assistance to be provided to the affected data subjects.

Where it is not possible to provide the foregoing information all at the same time, they may be provided in phases without undue delay.51

The submissions show that Orica complied with these obligations. Orica provided evidence of multiple efforts to reach affected data subjects through various communication channels.

A public notice was published on Orica’s website and disseminated through internal communications on 08 June 2018, describing the categories of data that may have been compromised and advising employees to change their login details.52

Orica likewise informed data subjects that it had suspended using PageUp immediately and instead use a manual process until a new system is implemented.53 Applicants with valid email addresses were individually notified through email, which detailed the recommended steps mentioned in the measures taken to address the breach.54

A global bulletin was published on 14 June 2028 and was sent to all employees via email informing them that certain personal information “may have been accessed” while also confirming that that PageUp encrypted login credentials at the same time of the incident.55

In addition, Orica engaged an external service provider, SMS Global, to send SMS notifications to potentially affected individuals.56 The samples of notification letters,57 employee notices58 and email correspondence59 with Philippine-based data subjects further demonstrate that Orica employed comprehensive notification measures consistent with Section 18 of NPC Circular 16-03.

Section 20 of the DPA requires personal information controllers (PICs) to implement reasonable and appropriate organizational, physical, and technical measures intended for the protection of personal information against any accidental or unlawful destruction, alteration and disclosure, as well as against any other unlawful processing.60

The record shows that Orica ceased all active job postings on the PageUp platform immediately upon learning of the incident.61 It also submitted reports to regulators in several jurisdictions, including Australia, Singapore, and the United Kingdom.62

PageUp, for its part, commissioned an independent forensic review which concluded that although the attackers successfully installed tools capable of data exfiltration, “no specific evidence was found confirming that any data was actually exfiltrated”.63

Orica submitted copies of PageUp’s manifestation of forensic findings, public bulletins, sample notifications, and internal employee advisories as part of its compliance.64 Moreover, Orica outlined its ongoing cybersecurity program, which consists of regular IT security awareness activities, multi-layered technical controls, and due diligence assessments of third-party systems aligned with recognized industry frameworks such as the NIST Cybersecurity Framework and ISO/IEC 27002.65

Taken together, these measures demonstrate that Orica undertook reasonable steps to contain the threat, determine the extent of the breach, notify affected individuals, and strengthen its security measures to reduce the likelihood of recurrence.

WHEREFORE, premises considered, the Commission hereby resolves that the matter of IN RE: ORICA AUSTRALIA PTY. TD. (NPC 18-094) be CLOSED.

SO ORDERED.

City of Quezon, Philippines.

20 November 2025

JOSE AMELITO SUTTON BELARMINO II
Deputy Privacy Commissioner

WE CONCUR:

JOHN HENRY D. NAGA
Privacy Commissioner

NERISSA N. DE JESUS
Deputy Privacy Commissioner

Copy furnished:

RLS

Chief Information Officer

AKB

General Counsel & Head of Regulatory Affairs, Asia

DAV

Data Protection Officer

CID, END, GRU

National Privacy Commission

Footnotes

Footnotes

  1. https://www.orica.com/About-Us. ↩

  2. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by Data Protection Officer. ↩

  3. Id. ↩

  4. Id. ↩

  5. Id. ↩

  6. Id. ↩

  7. Id. ↩

  8. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by Data Protection Officer. ↩

  9. Id. ↩

  10. Id. at Annex “A”. ↩

  11. Id. at Annex “A”. ↩

  12. Id. ↩

  13. Complaints and Investigation Division (CID) Order dated 10 October 2022. ↩

  14. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer. ↩

  15. Id. ↩

  16. Id. ↩

  17. Id. ↩

  18. Id. at Annex “A” (Joint Statement on the PageUp Limited Data Incident). ↩

  19. Id. at Annex “B” (‘No Evidence’ data stolen in Compromise: PageUp). ↩

  20. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer, at Annex “C” (PageUp communications broadcast report to Orica). ↩

  21. Id. at Annex “D” (PageUp data Breach Update Global Bulletin 08 June 20118). ↩

  22. Id. at Annex “E” (PageUp Data Breach Update Global Bulletin 14 June 2018). ↩

  23. NPC Minute Resolution dated 16 January 2025, signed by the Clerk of the Commission. ↩

  24. Id. ↩

  25. Compliance of Orica Australia Pty. Ltd. dated 04 March 2025, signed by the Chief Information Officer. ↩

  26. Id. at Annex “B” (PageUp System dated 08 June 2018). ↩

  27. Id. at Annex “C”(PageUp data breach updated dated 14 June 2018). ↩

  28. Id. at Annex “D”(External Email chain redacted). ↩

  29. Id. at Annex “E” (SMS Gblobal Tax Invoice/Receipt). ↩

  30. NPC Minute Resolution dated 08 May 2025, signed by the Clerk of the Commission. ↩

  31. Email Receipt, dated 24 June 2025. ↩

  32. Id. ↩

  33. NPC Minute Resolution dated 03 July 2025, signed by the Clerk of the Commission. ↩

  34. Email Receipt dated 28 July 2025, sent from XXX to adjudication@privacy.gov.ph. ↩

  35. Compliance of Orica Australia Pty. Ltd., Statutory Declaration dated 28 July 2025, signed by Manager of Cyber Governance, Architecture & Risk. ↩

  36. National Privacy Commission, Personal Data Breach management, NPC Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], (15 December 2016). ↩

  37. Id. at Section 11. ↩

  38. In re: Commission on Elections, Smartmatic Group of Companies, RVA, WS, and other John Does and Jane Does, NPC SS 22-001 and NPC SS 22-008, at p. 19, https://privacy.gov.ph/wp-content/uploads/2024/05/NPC-SS-22-001-and-NPC-SS-22-008-2022.09.22-In-re-COMELEC-Decision-FinalP.pdf (last accessed on 06 December 2025). ↩

  39. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 3 (l), Chapter I (2012). ↩

  40. In Re: E-Science Corporation, NPC BN 20-124, at p. 3, https://privacy.gov.ph/wp-content/uploads/2024/09/NPC-BN-20-124-2020.09.10-In-re-E-Science-Corporation-Resolution.pdf (last accessed on 05 December 2025). ↩

  41. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by the Data Protection Officer. ↩

  42. Id. ↩

  43. In Re: E-Science Corporation, NPC BN 20-124, at p. 3, https://privacy.gov.ph/wp-content/uploads/2024/09/NPC-BN-20-124-2020.09.10-In-re-E-Science-Corporation-Resolution.pdf (last accessed on 05 December 2025). ↩

  44. Id. ↩

  45. National Privacy Commission, Personal Data Breach management, NPC Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], Section 11 (B) (15 December 2016). ↩

  46. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by the Data Protection Officer. ↩

  47. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer. ↩

  48. In re: Easytrip Services Corporation, NPC BN 17-078 and NPC BN 18-180, at p. 8, https://privacy.gov.ph/wp-content/uploads/2024/06/NPC-BN-17-028-_-18-180-2023.05.11-Resolution-FinalP.pdf (last accessed on 05 December 2025). ↩

  49. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer, Annex “A”. ↩

  50. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by Data Protection Officer. ↩

  51. National Privacy Commission, Personal Data Breach management, NPC Circular No. 03, Series of 2016 [NPC Circ. No. 16-03], Section 18 (C) (15 December 2016). ↩

  52. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer. Annex “D” (PageUp data Breach Update Global Bulletin 08 June 20118). ↩

  53. Id. ↩

  54. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by Data Protection Officer. ↩

  55. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer, Annex “E” (PageUp Data Breach Update Global Bulletin 14 June 2018). ↩

  56. Compliance of Orica Australia Pty. Ltd. dated 04 March 2025, signed by the Chief Information Officer. ↩

  57. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer, Annex “C”. ↩

  58. Id. at Annex “D” and “E”. ↩

  59. Compliance of Orica Australia Pty. Ltd., Statutory Declaration dated 28 July 2025, signed by Manager of Cyber Governance, Architecture & Risk, Annex “D”. ↩

  60. An Act Protecting Individual Personal Information in Information and Communications Systems in the Government and the Private Sector, Creating for this Purpose a National Privacy Commission, and for Other Purposes [Data Privacy Act of 2012], Republic Act No. 10173, Section 20, Chapter V (2012). ↩

  61. Incident Report from Orica Australia Pty. Ltd, dated 18 June 2018, signed by Data Protection Officer. ↩

  62. Id. ↩

  63. Compliance of Orica Australia Pty. Ltd. dated 25 October 2022, signed by the Chief Information Officer. ↩

  64. Id. ↩

  65. Id. ↩

Backlinks

  • No backlinks found