GCash says systems secure as privacy commission probes alleged data leak

ELECTRONIC WALLET platform GCash said its systems remain secure following a forensic investigation that found no breach after reports emerged claiming that user data were being sold on the dark web.

“Initial forensic analysis shows no compromise in GCash systems; data under circulation does not match official records or customer information,” the company said in a statement on Monday.

GCash, operated by G-Xchange, Inc., said it immediately launched an investigation with cybersecurity experts and relevant authorities to verify the authenticity of the claims.

“The security and privacy of our users remain our highest priority. We take these allegations seriously and immediately launched an investigation with our cybersecurity experts and relevant authorities to verify the authenticity of these claims,” the company said.

According to GCash, its initial findings showed that the alleged dataset did not match the structure used within its systems and contained entries from individuals who are not GCash users. Many of the records, it said, were “incomplete, inconsistent, or invalid.”

“These findings strongly indicate that the material being circulated did not originate from GCash. At this time, there is no evidence of any breach in GCash systems. All customer accounts and funds remain secure,” the company said.

GCash said it continues to coordinate with the Bangko Sentral ng Pilipinas, the National Privacy Commission (NPC), and the Cybercrime Investigation and Coordinating Center to verify the reports and further strengthen its systems.

Meanwhile, the NPC said it has launched its own investigation to determine whether personal data of GCash users have been compromised.

“Should the investigation confirm that the personal data of GCash users have been compromised, the NPC will take regulatory and enforcement action within its mandate,” the commission said. — Ashley Erika O. Jose