THE National Privacy Commission (NPC) on Thursday confirmed data breaches at two private companies following claims by a cybersecurity enthusiast group that customer data was being offered for sale online.

The NPC said that real estate firm Robinsons Land and carmaker Toyota had notified it of data breaches on June 1 and May 14, respectively.

"The NPC takes all allegations of data breaches very seriously and is actively monitoring the situation to ensure the security and privacy of all concerned data subjects," NPC Compliance and Monitoring Division chief Rainier Milanes said.

A post on the Kukluban Philippines website on Tuesday claimed that personal information from Toyota Makati, Robinsons Malls and membership shopping club S&R had been compromised.

The data was said to include complete names, addresses, bank documents, valid IDs, email addresses, mobile numbers and birthdates.

S&R as of press time had yet to comment on the report.

"The NPC takes all allegations of data breaches very seriously and is actively monitoring the situation to ensure the security and privacy of all concerned data subjects," Milanes said.

"We encourage data subjects who believe they may be part of any breach to contact the data protection officers of the respective companies and report the same to the NPC," he added.

The NPC also said that the Philippine National Police (PNP) had also reported six data breach notifications in May.

The PNP suspended its online services last month as a precautionary measure.

The affected companies and individuals processing personal data "must notify affected data subjects individually and report to the Commission via the Data Breach Notification Management System within 72 hours of discovering a breach," the NPC said.

A recent report from cybersecurity firm Kaspersky Security Network said that the Philippines ranked first in Southeast Asia and fourth globally among countries most targeted by web threats in 2023.

Latest PNP Anti-Cybercrime Group data, meanwhile, showed that a total of 4,469 cybercrime incidents were logged from January to March 2024, a 21.84-percent increase from the 3,668 incidents in the fourth quarter of 2023.