COMELEC (Philippines Voters) comelec.gov.ph COMELEC Philippines voter data breach: what happened and what to do
In March 2016, the Philippines election commission (COMELEC) was hacked and voter data leaked. Have I Been Pwned lists 228,605 email addresses, with names, passport numbers, birth dates and biometric data.
View all 13,115 breaches- Breach date
- 27 Mar 2016
- Affected
- 228,605
- Data exposed
- Biometric data, Dates of birth, Email addresses, Family members' names, Genders, Job titles, Marital statuses, Names, Passport numbers, Phone numbers, Physical addresses, Physical attributes
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
In March 2016, the website of the Philippines Commission on Elections (COMELEC) was defaced, allegedly by Anonymous Philippines. Shortly afterward, data on about 55 million Filipino voters was posted publicly. Have I Been Pwned (HIBP) describes it as including genders, marital statuses, height and weight, and biometric fingerprint data.
HIBP's own entry covers 228,605 email addresses, because only that part of the data is searchable there. The data classes it lists are biometric data, dates of birth, email addresses, family members' names, genders, job titles, marital statuses, names, passport numbers, phone numbers, physical addresses and physical attributes. The 55 million figure comes from press reports of the leak, not from a count of people who were affected.
Security researchers at Trend Micro said much of the sensitive data was sitting in plain text, and reporting noted records of overseas voters that included passport numbers. COMELEC at first said no sensitive information had been exposed, and later apologized and told the public to change passwords. The Philippine National Bureau of Investigation arrested a suspect about a month later.
This is a different kind of exposure from a password leak. You can change a password but not a fingerprint, a birth date or a passport number. That's why the risk is identity fraud and impersonation over many years, plus phishing that uses real family names and addresses to sound credible.
What to do if you were in it
- 1
Treat unexpected contact as a scam
Names, phones, addresses and relatives' names were exposed. If a caller or message uses them to sound official, hang up and call the organization back on a number you looked up yourself.
- 2
Watch for identity fraud
Passport numbers and birth dates don't expire. Check your credit file where you live, and be careful about who you share ID scans with. If a passport number was exposed, ask the issuing authority what replacement options exist.
- 3
Update passwords and turn on 2FA
If you used your COMELEC password anywhere else, change it. Turn on two-factor authentication on email and banking.
- 4
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web for your email, phone number and passwords, and alerts you when they show up. You can run a free scan at serus.ai. Serus can't remove data from a breach, but it tells you what to change.
Frequently asked
Was I affected by the COMELEC breach?
If you were registered to vote in the Philippines in 2016, possibly. Press reports put the leak at about 55 million voters. Have I Been Pwned lets you search 228,605 email addresses from it.
What was exposed?
Have I Been Pwned lists biometric data, dates of birth, email addresses, family members' names, genders, job titles, marital statuses, names, passport numbers, phone numbers, physical addresses and physical attributes.
Should I change my password?
Yes, if you reused a COMELEC password elsewhere. COMELEC itself told the public to change passwords after the leak.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
