WHO database, including COVID-19 records, hacked

MANILA, Philippines — Sensitive personal information related to the Philippines’ coronavirus vaccine program may have been accessed by cyber hackers who breached the World Health Organization (WHO) database, the Department of Information and Communications Technology (DICT) confirmed yesterday, as the Department of Health (DOH) said it is coordinating with both agencies.

Renato Paraiso, DICT assistant for legal affairs and department spokesman, said the DICT’s computer emergency response team confirmed the COVID-19 vaccination database of the WHO for the Philippines and India was compromised.

At risk are sensitive personal information of people who signed up for the COVID-19 vaccination program including their full names, addresses, birthdays, mobile numbers, email addresses, blood types and medical histories.

In a phone interview with The STAR, Paraiso said they have not yet ascertained the extent of the compromise of Filipinos’ sensitive personal information and that the DICT-CERT had only confirmed the breach through a data check on various platforms and the dark web.

“To the extent of it, we cannot ascertain,” Paraiso said, adding that finding out the extent would entail that the WHO would “acknowledge that there was indeed a breach.”

Paraiso said that as of yesterday, they were waiting for WHO to come clean on any database breach.

He told The STAR that the DICT can only wait for the WHO to acknowledge a breach of their database and provide a report on the extent of the breach.

“The problem there is that they are an international institution which we do not have jurisdiction over,” Paraiso pointed out.

“Our capability is limited because from all indications this is an international organization that was hacked and our jurisdiction is very limited. As far as we can say, it’s all COVID-19 related information,” said Paraiso in a report on “24 Oras” last Monday.

“If it can be linked to your financial data, then it’s possible. I don’t want to downplay it and say it won’t happen. It’s possible,” Paraiso was quoted as saying by GMA Integrated News.

“In response, the DOH is currently in close coordination with the WHO and the DICT to ascertain the veracity of this report, as well as to determine the extent of any possible data breaches and the appropriate intervention should there be any,” Herbosa said in an interview. “The DOH assures the public that we will release additional information as they become available to us.”

Herbosa likewise said the Health department has adopted measures to ensure that that information being managed by the DOH remains safe.

Cases rising

The number of reported data breach on government agencies and private companies and organizations are a quarter percent higher this year compared to 2022, National Privacy Commission (NPC) chief information technology officer Rainier Anthony Milanes said.

Milanes said that as of Nov. 13, the NPC has already received 253 breach notification reports this year, compared to just 208 for the whole of last year.

Of the 253 reported breaches, Milanes said that 45 were on government agencies while 208 were on private companies and organizations.

Last year, the 208 total breach notification reports they received were broken down to 30 on government agencies and 178 on the private sector.

“These are only reported data breaches in our system,” Milanes said in a presentation yesterday at the Decode 2023 Resilience Rising cybersecurity conference spearheaded by IT security conglomerate Trend Micro in Mandaluyong City.

“The top general causes of data breaches were, number 1: human error. Malicious attack. And a combination of malicious attack and human error,” Milanes said.

Vaccine deaths

Meanwhile, nine individuals were confirmed to have died from causes related to COVID-19 vaccination, the DOH reported yesterday.

DOH Epidemiology Bureau director Alethea de Guzman said this during yesterday’s motu proprio hearing of the House committee on public order and safety on the “excess deaths” in the country in 2021.

“It’s called ‘adverse events following immunization’ of COVID-19. Actually, our latest tally is nine deaths, out of the 78 million doses that we administered,” she said, noting that half of these deaths were due to “anaphylactic reaction” or “sudden and very severe allergic reaction.”

“The term that the World Health Organization uses is ‘vaccine-associated.’ The experts are saying that it is the vaccines which caused the deaths of these nine people,” she added. — Rhodina Villanueva, Sheila Crisostomo