Alleged Globe Telecom Data Breach Claims 20GB of Subscriber and Internal Data
The threat actor, 4HMDOS4 has claimed responsibility for an alleged data breach involving Globe Telecom Philippines, claiming access to systems associated with the company’s infrastructure.
In a post on a dark web forum, titled “GLOBE TELCO PH (S2S INFRA DATABREACH),” was published at 5:59 AM and claims that approximately 20GB of data was obtained.
https://iili.io/nYSEtwJ.png
According to 4HMDOS4, the alleged dataset contains subscriber information, retailer information and internal documents. The claimed information includes subscriber names, activation dates, phone numbers, addresses and other account-related information.
https://iili.io/nYSEmnR.jpg
The post also claims that a 5,000-record sample involving subscriber and retailer data was made available, while stating that the larger dataset could either be sold or eventually released publicly.
https://iili.io/nYSEpGp.png
The exposed material also contains references to what appear to be internal applications, APIs and dashboards associated with functions including dealer, retailer, distributor, email services, payment-related operations and telecommunications services. It also shows API-related activity involving session information and internal service endpoints.
The material indicates possible access to internal systems, but it does not independently establish how the access was obtained, whether the systems remain compromised, or whether every dataset claimed by 4HMDOS4 originated from Globe's production environment.
The alleged database contains fields corresponding to:
• Subscriber information
• Subscriber/account numbers
• Mobile numbers
• CPE serial information
• Network or service information
• Account/service status
• Retailer-related information
4HMDOS4 additionally claims that the dataset contains internal documents and retailer information, alongside subscriber records.
In the post, 4HMDOS4 also alleges that Globe and Converge followed orders from the Department of Information and Communications Technology (DICT) and the National Telecommunications Commission (NTC) in restricting access to Discord and other platforms.
Globe yet to issue update
As of publication, Globe Telecom has yet to provide a public statement or update on the alleged breach. The company’s response, if issued, will be important in determining whether the claimed access and data exposure are authentic and establishing the actual scope of the incident.
