File-borne breach events · Southeast Asia
Philippines: documented file-borne breach events
The Philippine privacy regulator publishes resolutions that name the mechanism, and two of them document files: malicious Excel attachments that opened a cruise operator's network, and a credential harvesting file mailed to 387 recipients.
Overview
What the record shows
The National Privacy Commission publishes breach resolutions in unusual detail, and that cuts both ways for this record. Most of the country's famous incidents are documented as something other than file-borne: the commission's own resolutions attribute them to web application compromise, payment page skimming and, in one case, an employee who sold his credentials. Those are excluded here on the regulator's own evidence rather than on our assumption.
Two resolutions do document files. The Costa Crociere case records malicious Excel attachments opened by employees as the start of the intrusion, which is as clean a file-borne finding as any regulator in the region has published. The PowerVision case documents the other direction of travel, a compromised mailbox used to send a credential harvesting file to hundreds of recipients, and it is recorded here with that distinction stated plainly.
Documented events
File-borne incidents in Philippines
Most recent first. Every entry cites the public record it is drawn from.
-
PowerVision EAP, Inc.: Compromised mailbox mailed a credential harvesting file to 387 recipients
PowerVision's administrative mailbox was compromised on 20 May 2021 and used to send credential harvesting emails to 387 recipients from the company's own address. The company deactivated the account and imposed multi-factor authentication across all email accounts four days later. The commission found insufficient grounds for a notification exemption and ordered notification plus the missing breach report details.
The documented vector. Audio file that prompted the recipient to enter their Outlook email address and password. The commission's order records that the company's administrative mailbox was reached by password cracking, not by a file, and was then used to send emails containing an audio file that would require the person accessing it to input the Outlook email and password. The file-borne element of this event is that outbound wave, and this entry does not claim otherwise about the initial compromise.
How this class of vector is removed
This class of vector is instructive from the receiving side: 387 recipients were sent a file from a genuine, trusted sender address, so sender reputation offered them nothing, and inbound mail from a trusted correspondent is processed exactly as any other mail is. Where the attachment is a supported document format it is rebuilt to its known good specification. The commission describes the carrier only as an audio file that prompted for credentials, which does not establish which of those two outcomes applies, so the mapping is held at low confidence.
Content Disarm and ReconstructionEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- services
-
Costa Crociere S.p.A. (AIDA Cruises): Malicious Excel attachments opened the intrusion that exposed 74,000 Filipino data subjects
After the Excel attachments were opened on 21 December 2020, the attacker exfiltrated roughly 1.1 terabytes of data and deployed DoppelPaymer ransomware, detected on 25 December. About 74,000 Filipino data subjects, guests, employees and crew, had names, dates of birth, passport numbers, nationality and trip data exposed. The commission denied the operator's request for exemption from individual notification, ordered notification and the overdue full breach report, and required it to show cause against contempt proceedings.
The documented vector. Malicious Excel documents carrying SDBot remote access tooling. The National Privacy Commission's resolution records that the event began via multiple malicious Excel documents, sent by email, containing SDBot remote access tooling, which were opened by employees at AIDA. The attacker then pivoted from the AIDA network into the Costa network before deploying ransomware.
How this class of vector is removed
This class of vector, a spreadsheet carrying remote access tooling into an organisation by email, is a supported document format and is removed by deterministic rebuild: the workbook is reconstructed to its known good specification, so embedded active content does not survive into the file the employee opens, and macro intelligence inspects that active content for the policy decision. The Email CDR Relay places the rebuild on inbound mail, ahead of any verdict on whether the particular tooling is known.
Content Disarm and ReconstructionMacro intelligenceEmail CDR RelayGlasswall Halo / Glasswall Meteor / Glasswall Genesis
- travel
Scope
How to read this page
Every event on this page meets three tests before it is published. It is documented by reliable public sources: a regulator, an official inquiry, the affected organisation's own disclosure, or reputable press with named confirmation, and each entry links to those sources. The initial access or payload delivery travelled as a file, as the public record states it. And where an entry carries a prevention analysis, that analysis is bounded by what we can evidence; where an entry carries none, that is deliberate.
About the organisations named here. They are named because the public record names them, and for no other reason. Nothing on this page alleges fault, negligence or any breach of duty by any organisation or individual, and nothing here should be read as saying that anyone acted improperly or that their security arrangements were inadequate. Being attacked is not evidence of either, and the organisations on this page include some of the most heavily defended in the region. We summarise what published sources report and link to them so you can read them yourself. We have not independently investigated any incident and we hold no non-public information about any of them. Names are used to identify the organisations concerned; no affiliation with them, and no endorsement by them, is implied, and all trade marks remain their owners'.
About the prevention analysis. Where an entry describes how a class of vector is addressed, that is a general statement about how a control treats that class of content. It is not a claim that our products were in use, that they would have been deployed in that architecture, or that they would have prevented that incident. It is not an assessment of any organisation's actual controls, which we do not know. What a control achieves in practice depends on configuration, deployment and file type. Where an entry carries no prevention analysis, we are making no claim about that event either way.
Generally. This page is a working reference, not an incident report, a security assessment or legal advice, and it is provided without warranty. Details reflect the public record on the review date and may have changed since. If you believe anything here is inaccurate, incomplete or out of date, tell us and we will review it promptly and correct it where the record supports that.
Elsewhere in the region