POEA Data Leak Reported: 27 Backups Named After Agency Systems, Contents Unconfirmed

The security research firm Hunt.io reports that an operator copied 27 SQL Server backups, 68.837 GiB in total, whose file names point to the Philippine Overseas Employment Administration (POEA). Hunt.io has not opened the backups, and the operator’s log names no source server, so what they hold and where they came from are unconfirmed. This POEA data leak is a researcher’s report, not an agency finding.

What Did Hunt.io See?

Hunt.io says the operator left its working directory open on a Python web server at a Singapore hosting provider. The directory held more than 100 files, including a payload builder, two compiled payloads, a PowerShell stager, a full Impacket environment and the operator’s transfer logs. The server logged 543 requests from 76 addresses over about 16 hours.

The payloads are rebranded builds of GodPotato, a public .NET privilege escalation tool. The stager rebuilds the payload in memory, so no DLL touches the disk. Hunt.io stresses that this method needs no vulnerability, only a service account with the SeImpersonate privilege on a default Windows host.

On 6 September 2026, one address at a Philippine internet provider fetched the loader and both payloads, and a second fetched the source archive. Hunt.io says that shows delivery, not execution. It calls the link between file names and the agency a filename-based contextual assessment, not a confirmed identification.

Hunt.io’s headline says 68 GB and its log gives 68.837 GiB, about 73.9 GB in decimal units (our arithmetic). Hunt.io notes that the logged transfer rate does not match volume divided by duration.

The order of events matters. The copy finished at 01:26 on 6 September, and the first payload was fetched about 20 hours later. Hunt.io concludes the payload was not how the data left, so hardening against it may not have stopped the copy (our reading).

Who Should Act, and What Should They Do Now?

The file names suggest e-services, help desk, overseas worker and contract databases. If those backups are genuine, they could hold personal data of workers and employers. That is our reading of the names; Hunt.io has not confirmed contents. Hunt.io says it notified the national CERT before publication.

1. Hunt for the indicator types Hunt.io publishes: staging server addresses, file names and hashes, the named pipe used by the payload and the PowerShell stager. Check proxy and DNS logs from early September 2026.
2. List service accounts with the SeImpersonate privilege on IIS and SQL Server hosts, and remove it where it is not needed. See our entry on privilege escalation.
3. Alert on bulk outbound transfers from database servers, and on any read of .bak files by an account that is not the backup service.
4. Encrypt database backups, keep them off the database host and restrict who can read them. Our guide on responding to leaked databases covers the next steps.
5. Workers, recruiters and employers who deal with the agency should treat messages that quote contract details as suspect and verify them through official channels.

Steps 1 and 2 follow the detection and privilege points in Hunt.io’s write-up; steps 3 to 5 are our advice. The directory also held an Impacket toolkit. For the sector view, see our page for government and public sector teams.

What Is Still Open?

What would change our view: confirmation of the backups and their contents from the Department of Migrant Workers, the ICT department (DICT) or the National Privacy Commission. We will add it here once it is published.