PAGCOR, the Philippines' gambling regulatory authority, suffered a data leak involving its National Database of Restricted Persons, containing ~560,000 individuals barred from gambling including government officials and ~1,711 self-excluded problem gamblers. An international cybercriminal group disclosed the list, criticizing PAGCOR for inadequately addressing gambling addiction. While PAGCOR denied a direct breach of its systems, it acknowledged the leak occurred via a licensed gambling operator with authorized database access, exposing sensitive personal and professional data. The incident raises concerns over regulatory oversight, consumer protection failures, and the misuse of restricted data, potentially enabling exploitation of vulnerable individuals or reputational harm to public officials. The leak also underscores systemic vulnerabilities in third-party access controls within the gambling sector.
Source: https://www.newsnet5.com/news/pagcor-data-breach-exposes-560000-restricted-individuals/
TPRM report: https://www.rankiteo.com/company/pagcor-philippines-amusement-and-gaming-corporation
"id": "pag523090325",
"linkid": "pagcor-philippines-amusement-and-gaming-corporation",
"type": "Breach",
"date": "9/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'customers_affected': '560,000 individuals (including '
'government officials, public '
'servants, and 1,711 '
'self-excluded problem gamblers)',
'industry': 'gambling and gaming regulation',
'location': 'Philippines',
'name': 'Philippine Amusement and Gaming Corporation '
'(PAGCOR)',
'type': 'government regulatory authority'},
{'industry': 'gambling',
'location': 'Philippines',
'name': 'Unnamed licensed gambling operator',
'type': 'private entity'}],
'data_breach': {'data_exfiltration': ['leaked to public by cybercriminal '
'group'],
'number_of_records_exposed': '560,000',
'personally_identifiable_information': ['names',
'restriction reasons '
'(e.g., government '
'role, '
'self-exclusion)'],
'sensitivity_of_data': ['moderate (personally identifiable '
'information without financial or '
'highly sensitive details)'],
'type_of_data_compromised': ['names of restricted individuals',
'government officials and public '
'servants',
'self-excluded problem '
'gamblers']},
'description': 'The Philippine Amusement and Gaming Corporation (PAGCOR) '
'experienced a significant data incident involving its '
'National Database of Restricted Persons. An international '
'cybercriminal group leaked a list of approximately 560,000 '
'individuals barred from gambling activities, including '
'government officials and public servants. PAGCOR denies a '
'direct breach of its systems, suggesting the data was '
'accessed via a licensed gambling operator with authorized '
'access to the database. The hackers criticized PAGCOR for '
'allegedly enabling gambling addiction and insufficiently '
'addressing problem gambling.',
'impact': {'brand_reputation_impact': ['negative media coverage',
'accusations of enabling gambling '
'addiction',
'perceived failure in responsible '
'gaming practices'],
'data_compromised': ['National Database of Restricted Persons '
'(560,000 records)'],
'identity_theft_risk': ['low (primarily names of restricted '
'individuals)'],
'operational_impact': ['reputational damage',
'policy scrutiny',
'public distrust in gambling regulations']},
'investigation_status': ['ongoing (PAGCOR denies direct breach, attributes '
'leak to licensed operator)'],
'lessons_learned': ['Need for stricter access controls for third-party '
'operators with authorized database access',
'Importance of addressing public perception of gambling '
'addiction policies',
'Enhancement of consumer protection measures in gambling '
'regulation'],
'motivation': ["activism (criticism of PAGCOR's gambling policies)",
'public shaming'],
'post_incident_analysis': {'root_causes': ['Potential insufficient access '
'controls for licensed operators',
'Lack of monitoring for '
'unauthorized data disclosure by '
'authorized parties',
'Policy gaps in addressing '
'gambling addiction concerns']},
'recommendations': ['Audit and restrict third-party access to sensitive '
'databases',
'Implement stronger monitoring for unauthorized data '
'exfiltration',
'Review and improve policies for self-exclusion and '
'problem gambling support',
'Enhance transparency in communicating data protection '
'measures'],
'references': [{'source': 'Cyber incident report (summary provided)'}],
'response': {'communication_strategy': ['media statements',
'clarification on composition of '
'restricted list'],
'remediation_measures': ['public denial of direct system breach',
'attribution of leak to licensed '
'operator']},
'threat_actor': ['international cybercriminal group'],
'title': 'PAGCOR National Database of Restricted Persons Data Leak',
'type': ['data leak', 'unauthorized data disclosure']}