PNP Anti-Cybercrime Group Webmail Access Was Listed For Sale on Dark Web for $5,000
August 15, 2025 – Manila, Philippines — A verified live access to the official Philippine National Police Anti-Cybercrime Group (PNP ACG) webmail had been offered for sale on a dark web forum this week, raising serious concerns over the security of law enforcement communications and sensitive investigations.
The seller and threat actor, using the handle "smayka", posted the listing on August 10, 2025, offering exclusive control of a PNP ACG webmail account with no multi-factor authentication (MFA) enabled. The inbox reportedly contained approximately 4.76 GB of data, equivalent to 5,992 internal messages: including operational correspondence, legal documents, and case-related files.
https://iili.io/FbFmKzX.png
https://iili.io/FbFmfXn.png
According to the post, the access allowed the buyer to:
• Read, send, and delete emails in real time.
• View and handle sensitive legal, operational, and intelligence communications.
• Potentially submit or view law enforcement data requests to major tech companies.
• Monitor ongoing anti-cybercrime operations and case correspondence.
A screenshot provided by the seller as “proof of life” showed the inbox containing messages from various PNP ACG regional units, tactical operation centers, and specialized cybercrime divisions, with subjects referencing court orders, cybersecurity delegation visits, and E911 system clarifications.
The listing had originally been priced at $2,500 USD, but the threat actor later updated the same forum post to raise the price to $5,000 USD, likely as a correction or adjustment to its perceived value. Payment was accepted in Bitcoin (BTC) and Monero (XMR). The seller claimed the access came with “fresh 2025 data” and possible ongoing updates. They also stated that no backdoors would be left behind, and that the account would not be resold (1/1 exclusive).
The incident was immediately investigated by the team and found it is indeed a genuine PNP ACG account containing authentic internal communications and case-related materials. However, the DWK Team’s independent investigation could not confirm whether the compromise originated from a broader system vulnerability. According to a source with direct knowledge of the matter, a security review was conducted and no exploitable vulnerabilities were detected. The compromised account has since been secured and is no longer accessible.
Had the access remained open, malicious actors could have used it to conduct espionage, sabotage, or interfere with active investigations, as well as impersonate law enforcement personnel to issue fraudulent data requests.
The public sale of such access underscored the vulnerability of government email systems to targeted cyber intrusions and the importance of strengthening digital defenses.
