Hackers Copied 69GB of Philippine Migrant Worker Records in 24 Minutes, Then Left Their Server Wide Open

In 24 minutes, an unknown attacker walked off with nearly 69GB of data from the government agency that handles overseas employment for Filipino workers. The haul covered 27 backup databases from the Philippine Overseas Employment Administration, and nobody knows where it went next.

Threat hunting firm Hunt.io pieced the theft together from logs it found on a staging server in Singapore, sitting in address space belonging to Helsinki based UpCloud and exposed as an open directory. Its October 28 analysis, reported by Dark Reading, shows SQL Server backups covering the agency's overseas employment case management: accreditation, contracts, and cashier and LandBank records.

A trail that goes cold

The attacker came equipped. The logs show a rebranded version of the GodPotato privilege escalation tool, abuse of the SeImpersonate privilege, a PowerShell stager that unpacked tools in memory, and a full Impacket Python environment.

The trail stops at the Singapore server, which someone unknown accessed later. Esteban Borges, head of research at Hunt.io, said he would not claim the backups stopped there. He still counts it as a breach, because the data was copied out of the agency's control and the log shows the transfer completing. "We still can't answer ... how they got in, whether the payload ran, and where the data went," he said.

Hunt.io never opened the backups. It notified CERT-PH and the Department of Migrant Workers, and the data has not surfaced for sale or in a leak so far.

Fraudsters or spies

Who would want it? Borges sees two buyers. Personal data on migrant workers, combined with contract and payment records, "is useful for fraud and identity theft, so it has commercial value," he said. "It's also a detailed map of a diaspora population, which can interest a state actor."

Hunt.io did find Chinese language fragments, but they sat inside a third party library, so the firm declined to attribute the attack to anyone. Philippine networks do keep turning up in espionage reporting, including the telecoms hit in a Chinese state backed campaign that turned AI agents loose on 200 targets, but nothing ties this breach to that group or any other.

It is not the first Philippine haul Hunt.io has stumbled on. In August it found another actor's workspace holding 1.2GB stolen from a Philippine nuclear regulatory agency and a maritime shipbuilding contractor.

Skilled, but sloppy

Borges described an odd operator. The payload engineering was competent, but the operational security was poor: they left the staging server, logs and all, wide open for anyone to find. He would not call them top tier, and he would not call them amateurs either.

The agency's own exposure was not much better. Hunt.io found the migrant worker portal exposing risky services, including SMB on port 445 and WinRM on ports 5985 and 47001. Its advice is to shrink that attack surface and rein in over privileged accounts, before the next 24 minute window opens.

Some offers on this page may be paid placements or contain affiliate links.