69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server
In late October 2026, an unidentified threat actor breached the Philippine Overseas Employment Administration (POEA), exfiltrating approximately 69GB of sensitive data across 27 SQL Server backup databases in under 25 minutes. The attacker leveraged privilege escalation tools GodPotato and SeImpersonate alongside the Impacket Python library to move data to an open staging server hosted on UpCloud infrastructure in Singapore. Stolen records encompassed overseas-employment case management, accreditation files, contracts, and financial records including LandBank data. Threat intelligence firm Hunt.io discovered the breach by identifying an exposed open directory containing attack tools and transfer logs, though attribution remains unconfirmed. This incident underscores a troubling pattern of under-secured government portals in Southeast Asia being targeted for high-value diaspora PII. The combination of overprivileged service accounts, exposed management ports (SMB 445, WinRM 5985/47001), and the absence of egress controls enabled a rapid, high-volume exfiltration that mirrors tactics increasingly observed against public-sector entities across the Asia-Pacific region.
Kill Chain
