Alleged Philippine Air Force Command Clearance System Breach Surfaces on Underground Forum; 34,253 Documents Claimed Stolen
MANILA, Philippines — An alleged data breach involving the Philippine Air Force (PAF) has surfaced on an underground cybercrime forum, where a threat actor is advertising what it describes as stolen documents from the Philippine Air Force Command Clearance System.
The listing, published under the account name DNH@PH, carries the title "PHILIPPINE AIR FORCE (COMMAND CLEARANCE SYSTEM)" and includes a promotional image bearing the official Philippine Air Force insignia. The post alleges that the compromised system contains a substantial collection of sensitive government and military-related documents.
According to the threat actor's claims, the allegedly obtained dataset consists of approximately 34,253 PDF files, totaling around 1 GB. The listing identifies several categories of documents supposedly included in the collection, such as personnel documents, birth certificates, government-issued identification cards, marriage certificates, command orders, and Statements of Assets, Liabilities, and Net Worth (SALNs).
In the accompanying forum post, the threat actor directed criticism toward the Philippine government's cybersecurity infrastructure, specifically mentioning the National Security Operations Center (NSOC), the Department of Information and Communications Technology (DICT), and the Armed Forces of the Philippines (AFP) Cyber Command.
The post also questioned the effectiveness of existing security measures, including multi-factor authentication and geolocation-based restrictions, while criticizing the performance and maintenance of the systems allegedly involved.
Additionally, the threat actor claimed that the collection contains profiles of Major Generals, further raising concerns about the potential exposure of sensitive personnel information within the Philippine military establishment.
The post also made allegations concerning the deaths of six pilots, attempting to associate the incidents with alleged shortcomings in the institution's technological infrastructure.
Based on the description provided in the underground forum listing, the allegedly compromised collection includes the following:
• Personnel Documents – Records potentially containing personal and employment-related information of military personnel.
• Birth Certificates – Civil registry documents containing identifying information.
• Government-Issued Identification Cards – Identification records that could potentially be exploited for identity fraud and impersonation.
• Marriage Certificates – Civil documentation containing personal and family-related information.
• Command Orders – Military-related administrative documentation that may contain institutional information.
• Statements of Assets, Liabilities, and Net Worth (SALNs) – Financial disclosure documents that may contain sensitive personal and financial information.
