NPC, GCash Release Statements on Alleged Data Breach — CICC Confirms No Breach, Dark Web Post Taken Down
Both the National Privacy Commission (NPC) and GCash have issued official statements addressing the reported data leak involving G-Xchange, Inc., operator of the popular e-wallet app.
In a press release dated October 27, 2025, the NPC confirmed that it had launched an investigation into a dark web post allegedly offering GCash user data for sale. The post, attributed to a threat actor under the alias “Oversleep8351,” claimed to contain personal and financial details of users. The NPC issued a Notice to Explain (NTE) to G-Xchange, Inc. and scheduled an online clarificatory conference to discuss the incident.
Shortly after, GCash released a media statement assuring the public that its systems remain secure. The company emphasized that initial forensic analysis found no compromise in its databases, noting that the dataset in question does not match GCash records and even includes individuals who are not GCash users.
GCash said it continues to coordinate closely with the Bangko Sentral ng Pilipinas (BSP), the NPC, and the Cybercrime Investigation and Coordinating Center (CICC) to validate findings and ensure user safety.
Importantly, GCash confirmed that the CICC has cleared the company of any data breach, and the dark web post offering the alleged information has since been taken down.
