COMELEC

We've been tracking the resurgence of older data breaches, often resurfacing in aggregated credential stuffing lists or being repackaged on dark web marketplaces. What caught our attention wasn't the age of the 2016 COMELEC (Commission on Elections) breach from the Philippines, but the persistent availability of the voter data and the potential for its misuse in targeted phishing campaigns and identity theft. This breach, while initially reported focusing on the defacement and email addresses, held a far more significant dataset that continues to pose a risk.

The Philippine Election Commission Breach: A Persisting Threat

The COMELEC breach, which occurred on March 26, 2016, remains a significant event due to the sheer volume of personal data exposed. While initial reports highlighted the defacement of the website and the leakage of approximately 228k email addresses, the full extent of the breach included the personal information of an estimated 55 million Filipino voters. This data, including sensitive details like genders, marital statuses, height, weight, and even biometric fingerprint data, has been circulating in various forms since the initial leak.

The breach was initially attributed to Anonymous Philippines, who claimed responsibility for defacing the website. The motivation appeared to be a protest against alleged vulnerabilities in the COMELEC's online systems. The data itself was later dumped online, making it accessible to a wider audience. What makes this breach particularly concerning is the potential for long-term misuse of the data. With such a comprehensive profile of millions of individuals, malicious actors can craft highly targeted phishing campaigns, engage in identity theft, or even attempt voter suppression tactics.

This breach matters to enterprises because it highlights the long tail of data breaches and the continuing risk posed by older incidents. Even years after a breach occurs, the data can resurface, be combined with other datasets, and used in novel attacks. The COMELEC breach also underscores the importance of data minimization and the need to avoid collecting and storing sensitive data that is not strictly necessary. Its persistent availability and potential for misuse tie into the broader threat theme of large-scale data aggregation and the automation of attacks using readily available breach data.

• Total records exposed: ~55 million (voter records), ~228k (email addresses)
• Types of data included: Email addresses, genders, marital statuses, height, weight, biometric fingerprint data
• Sensitive content types: PII, biometric data
• Source structure: Database
• Leak location(s): Publicly available online
• Date of first appearance: March 2016

External Context & Supporting Evidence

News outlets such as Rappler covered the initial breach and the concerns raised by security experts regarding the potential impact on the integrity of the 2016 Philippine elections. They highlighted the sensitivity of the leaked data and the potential for identity theft and other fraudulent activities.

While direct links to specific forum threads are difficult to maintain due to their ephemeral nature, discussions about the COMELEC data have been observed on various online forums and dark web marketplaces over the years. These discussions often revolve around the potential for using the data in identity theft schemes or for creating targeted phishing campaigns.