Official Statement of Privacy Commissioner Raymund Enriquez Liboro on the Cebuana Lhuiller Breach
1. On Friday, 18 January 2019, representatives from Cebuana Lhuiller went to the National Privacy Commission to seek assistance regarding a data breach involving their email server. At the meeting, they committed to submit a more detailed report regarding the data breach. Cebuana Lhuiller informed us that it has engaged the services of a third party information security service provider to handle their mitigation and response to this incident.
2. We await further details as to scope and severity of the breach.
3. Cebuana Lhuiller has 72 hours from discovery of a data breach to report the same to the Commission and affected data subjects. The data subject notification must be done individually, and not further expose the data subject to more harm.
4. This incident is now under investigation.
