Happy Go Lucky PH Claims Exposure of 19 Million Filipino Records Through DILG Barangay Database
MANILA, Philippines — Cyber threat actor Happy Go Lucky PH has claimed to have gained unauthorized access to the Department of the Interior and Local Government's (DILG) Local Government Unit Support System (LGUSS), allegedly exposing approximately 19 million Filipino resident profiles and millions of supporting government documents.
In a post published on its social media account, the threat actor claimed that the compromised platform houses the national barangay resident database, including the Registry of Barangay Inhabitants (RBI) Form B records containing personal information of Filipino citizens.
According to the group's claims, the allegedly exposed database contains extensive resident information, including full names, dates and places of birth, residential addresses, civil status, voter registration details, contact information, and other sensitive personal records.
The threat actor further alleged that the exposure includes highly sensitive information such as identification photographs, signatures, and biometric-related records. The group claimed that approximately 19 million resident profiles and 2.6 million supporting documents, reportedly exceeding 500 GB of data, were accessible for download.
Happy Go Lucky PH attributed the alleged exposure to weaknesses in the system's authorization and access-control mechanisms. Specifically, the group claimed that the platform failed to properly verify whether requests to retrieve resident records were authorized, potentially allowing unauthorized parties to access and download information.
The group also published an accompanying image featuring DILG and LGUSS-related branding, alongside a photograph depicting a barangay hall transaction counter, apparently intended to draw attention to the alleged security incident.
Despite claiming access to the database, Happy Go Lucky PH stated that it would not publicly disclose or leak personally identifiable information (PII), particularly records involving children. The group instead blamed what it described as government negligence for the alleged exposure.
The threat actor also acknowledged assistance from an entity identified as DMW Server in obtaining the data, although no further technical details or independently verifiable evidence regarding the alleged collaboration were provided.
At the time of reporting, the allegations remain unverified. The actual scope of the purported exposure, the authenticity of the claimed dataset, and whether the information was successfully exfiltrated have yet to be independently established. No official confirmation or statement from the DILG regarding the incident was included in the threat actor's publication.
