Cyber attack

First it was the Philippine Health Insurance Corp. This week it was the turn of the Philippine Statistics Authority to confirm a data breach. People are wondering: how will hackers use the stolen PhilHealth and PSA data?

The two agencies have universal population coverage. Cyber experts had previously warned that such agencies would be the preferred targets of hackers.

Both PhilHealth and the PSA initially downplayed the extent of the hacking of their systems.

We now know that the PhilHealth data breach is more serious than it would have us believe.

As for the PSA, it said the hackers accessed only its Community-Based Monitoring System. It said the national identification system and Civil Registration System were not affected.

The national ID was originally seen to serve as the backbone for reliable verification for mandatory SIM registration.

With the PSA data breach, people now think it’s a blessing in disguise that mandatory SIM registration was rolled out even before the completion of national ID registration.

Monkey and SpongeBob images have been accepted for SIM registration, and the law does not cover popular messaging apps such as Viber and Telegram.

Since SIM registration became mandatory, I’ve been scammed through Viber and email, with payment made through GCash. I took the trouble of reporting the scam to the Philippine National Police Anti-Cybercrime Group in Manila, thinking that the GCash account at least might be traced. This was on Aug. 29. I’m still waiting for any progress on the case.

Apart from the scam, I can’t get rid of Viber ads for Monopoly, no matter how many times I keep clicking on the line that says it’s spam. Text messages offering loans and advertising online cockfights never stopped.

*      *      *

How hackers will use data stolen from PhilHealth and the PSA is anybody’s guess. If the agencies themselves aren’t even sure about the extent of the breach, how can we foresee the possible damage?

Cyber experts have said that the data stolen from PhilHealth can be used to make fraudulent claims. So PhilHealth has suspended the processing of claims.

The Private Hospitals Association of the Philippines has lamented that as a consequence, smaller hospitals might soon be unable to accept PhilHealth-funded cases – meaning all patients will have to pay out of pocket for hospital services.

Health records are confidential, and the hackers can use the data for harassment. The president and vice president of the republic, or candidates for the post, usually lie about their state of health – but they are not the type who need PhilHealth to pay for their medical expenses. There are many other people, however, who have used PhilHealth and prefer to keep their health records confidential, for various reasons including, simply, a preference for privacy.

Data from PhilHealth and the PSA can also be used for identity theft to commit a wide range of illegal activities, cyber experts have warned.

*      *      *

There are concerns that the data breaches may just be test runs for bigger cyber attacks, with more serious consequences.

Such concerns have become a national security issue, amid the possibility that the next wars will be fought in cyberspace. In the age of artificial intelligence and ChatGPT, this scenario no longer seems farfetched.

Cyber warriors can sabotage electrical grids, for example, or wreak havoc on air traffic control, paralyzing air travel or causing catastrophic accidents.

Private enterprises are vulnerable, cyber experts have also pointed out. Alongside the confirmation of the PSA data breach, De la Salle University announced a “data security incident” that made its online system inaccessible.

Will the hacking incidents increase? Or, considering limited capabilities and resources for fighting cybercrime, will we see things get worse before they get better, and this would be the best-case scenario?

Surely no one wants to see things getting worse. The government must show that it has the capability to catch hackers, and impose heavy punishment.

There lies our problem… the capability isn’t there. The law enforcement anti-cybercrime units seem overwhelmed. Lawmakers are stripping or cutting the confidential funds of the Department of Information and Communications Technology (DICT) reportedly because of poor fund utilization rate.

DICT Secretary Ivan Uy, on the other hand, says the government can’t afford to hire enough personnel to foil hackers. The task requires a high level of special skills, and that kind of talent doesn’t come cheap. Maybe Uy wants to put such personnel under the regular DICT plantilla instead of sourcing their salaries from secret funds. So why not increase the regular budget of the DICT?

The government has also appealed to the private sector for help in preventing further cyber attacks on government networks. Such acts of civic / social responsibility can be difficult when you see public officials being profligate with our tax money, and sneering when you demand accountability. But some level of cooperation is possible.

We can’t just sit around, waiting for the next attack to happen, with the possibility of dire consequences.