"Cyber threats and attacks will escalate as months go by", Information and Communication Technology Secretary Henry Aguda said following multiple cyber threats monitored targeting various government agencies.

In an interview with reporters during the launching of the Philippine AI Infrastructure Master Plan on Tuesday, Aguda expressed alarm on the recent cyber threats against government agencies including Department of Migrant Workers (DMW), Department of Labor and Employment (DOLE) and Philippine Ports Authority (PPA).

"The cybersecurity threat is ongoing. What is alarming is that recently, there have been targeted agencies. Some were prevented, some have pushed through, like Marina, they're still restoring their system, but they were able to contain the problem. Then DOLE, they've been able to fix the issue. And there are several now we were able to prevent," he said.

"I think cyber threats and cyber attacks will just escalate as the months go by. So we're getting prepared naman for that," he added.

In a press statement on Monday, the DICT Cybersecurity Bureau, through the National Computer Emergency Response Team (NCERT) announced that it is actively responding to multiple cyber threats which includes unauthorized access to the website of the Department of Migrant Workers (DMW), a web defacement incident involving the Department of Labor and Employment (DOLE), and an alleged ransomware attack affecting the Philippine Ports Authority (PPA).

"In response to the unauthorized access detected on the DMW website, the DICT activated emergency incident protocols through direct coordination and on-site technical response with the DMW Management Information Technology Service (MITS). Joint technical teams immediately implemented access-control hardening and system isolation measures in aid of the ongoing forensic investigation and system recovery," it stated.

"Upon detecting the unauthorized modification on the DOLE web host, the DICT promptly notified DOLE IT administrators and initiated coordinated response protocols. Designated agency focal persons confirmed that primary system and access-control measures were immediately enforced to isolate the affected node, support ongoing digital forensics, and facilitate safe system restoration. Initial technical assessments confirm that no sensitive databases or Personally Identifiable Information (PII) were compromised," the agency added.

Following the attack, the affected web services at DMW and DOLE have been temporarily taken offline as a precautionary measure to ensure complete threat eradication and security hardening.

"NCERT and agency technical teams are actively collaborating to finalize root-cause investigations and safely restore full web service availability," it added.

However, following a subsequent technical assessment confirmed that no ransomware activity or system compromise occurred within PPA infrastructure.

"Investigation and mitigation procedures continue to be actively conducted by technical teams from the DICT and partner agencies. Securing our national network infrastructure and preserving the confidentiality, integrity, and availability of public information remain our highest priority," the DICT said. Robina Asido/PHS