Philippines saw credential theft surge to 19.2 million in H1 2026 as AI supercharges phishing

[RealChristopher10]

A new Cyber Threat Landscape Report from Viettel Cyber Security found that more than 19.2 million account credentials were compromised in the Philippines during the first half of 2026, a huge jump from just 3.79 million recorded during the same period the previous year. The report, based on data from Viettel's own threat monitoring platform, also tracked 255 separate data breach incidents that collectively exposed roughly 335 million records and 2.6 terabytes of data, alongside 16,619 phishing attacks and 21 ransomware incidents nationwide between January and June.

The most serious individual incidents targeted the financial sector specifically. Coordinated attacks against financial institutions between March and April alone compromised approximately 99 million records, and a separate breach affecting a public service organization exposed another 45 million. A different attack reportedly exfiltrated around 1.8 terabytes of confidential internal data from financial institutions after attackers deployed malicious software directly inside enterprise systems, rather than relying purely on external phishing or credential theft to get in.

What's driving the report's headline concern isn't just the raw volume of these numbers, it's the increasingly coordinated way different attack techniques are getting chained together. Viettel specifically flagged how generative AI is making traditional phishing dramatically harder to spot, since attackers can now combine previously stolen personal information with AI generated deepfake voices or videos impersonating bank staff, government officials, or even relatives, moving well past the old, easily spotted fake emails full of typos and generic threats. The report also identified 77 high impact software vulnerabilities affecting products and services widely used across the Philippines, underscoring how unpatched systems keep serving as reliable entry points regardless of how sophisticated the eventual attack technique turns out to be.

Finance, hospitality, logistics, manufacturing, and energy emerged as the hardest hit sectors overall. Viettel's basic recommendation for organizations is straightforward even if it's not glamorous, treat regulatory compliance as a genuine floor rather than a finish line, patch known vulnerabilities faster, and invest in security monitoring and employee training that specifically accounts for how convincing AI generated deception has become, rather than relying on older instincts people developed spotting cruder, more obviously fake scam attempts

Phishing, data breaches surge in PH in first half of 2026newsbytes.ph