Alleged DOTr HRIS Data Breach Exposes Employee Records, Payroll Information, and Biometric Data
MANILA, Philippines — An alleged data breach involving the Philippine Department of Transportation (DOTr) Human Resource Information System (HRIS) has surfaced on an underground cybercrime forum, with a threat actor claiming to have obtained extensive personnel, payroll, attendance, and other sensitive organizational data.
The claim was published on November 5, 2026, by a forum user operating under the alias sinigangmixwithgabi, who advertised what was described as a complete collection of DOTr personnel and payroll-related information.
According to the threat actor's post, the allegedly compromised information includes records associated with approximately 4,534 employees. The advertised dataset reportedly contains personal and employment information, including employee names, birth details, contact information, employment records, and other personnel-related information.
The threat actor also claimed to possess payroll records covering approximately 14,827 ledger entries, reportedly containing salary and deduction information, alongside attendance and timekeeping records involving millions of entries.
Other categories of allegedly compromised information include:
- Employee records: Personnel information, contact details, employment information, and government-related identifiers.
- Payroll information: Salary records, deductions, and associated banking information.
- Attendance records: Employee clock-in and clock-out logs, daily time records, and leave history.
- User account information: Thousands of account records, reportedly containing password hashes and authentication-related tokens.
- Biometric information: Allegedly includes RFID-related identifiers and fingerprint templates.
- Employee family and service history: Information relating to dependents, educational background, employment history, and service records.
- Human Resources documents: More than 1,300 reportedly collected HR-related PDF documents.
- Source code and internal configurations: Alleged copies of application source code and associated development files.
- Server configuration information: The actor further claimed possession of internal configuration files and authentication-related secrets.
The threat actor also published several DOTr-related subdomains as allegedly defaced during the incident. The listed subdomains were:
- prot1.dotr.gov.ph
- prot2.dotr.gov.ph
- prot3.dotr.gov.ph
Defacement Status:
As of the latest checking, the three reported defaced subdomains are now offline or have been taken down. Their current unavailability suggests that the previously reported defacement pages are no longer accessible. However, their removal does not independently establish whether the underlying systems have been fully secured or whether the alleged data exposure has been contained.
The claims regarding the extent of the alleged compromise, the authenticity of the advertised datasets, and the actual acquisition of the information have not been independently verified.
No official confirmation from the Department of Transportation regarding the incident was established at the time of writing.
