Philippine organisations faced a sharp escalation in high-impact cyber attacks during the first eight months of 2026, with public ransomware claims more than doubling and cyber criminals increasingly relying on AI-enabled deception, stolen credentials and social media impersonation, according to Check Point Software Technologies’ 2026 Philippines Threat Landscape Report.
Check Point’s Exposure Management Research analysed cyber activity from January to August 2026. It recorded 31 public ransomware claims against Philippine organisations, exceeding the 26 cases logged across 2024 and 2025 combined. Fifteen distinct ransomware groups posted local claims during the period, compared with 12 throughout 2025, while 10 groups appeared in the local dataset for the first time.
Qilin remained the most active group, accounting for 29% of local claims in 2026, up from 23% in 2025. The report also found that eight sectors—including government, business services and critical infrastructure—were newly represented in ransomware claims after recording none during the same period in 2025.
Government and finance exposed
Government agencies recorded the highest overall volume of attacks, with 72 incidents, driven largely by public-facing website defacements and information-system disruptions. Financial institutions, however, faced the highest concentration of severe threats: more than half of their recorded incidents involved ransomware, data breaches or leaks.
The broader threat picture included 24,875 data exposure cases. Nearly 44 per cent stemmed from hidden malware scraping credentials from infected devices, while almost 24 per cent involved exposed payment card data. A further 10 per cent related to employee credentials leaked through third-party platforms, underscoring risks arising from weak access controls and supply-chain exposure.
Phishing volume held steady at 2,386 alerts, but attackers changed tactics. Rather than intercepting one-time passcodes, they used fake reward points and loyalty-programme updates to obtain personal information and payment card details. Alerts peaked at 518 in January before falling to 117 in May, a decline Check Point said may be linked to the enforcement of Bangko Sentral ng Pilipinas Circular No. 1213.
Trust becomes the attack surface
Social media impersonation also surged. Check Point logged 1,194 alerts, of which 972 involved company impersonation and 222 involved executive impersonation. Facebook accounted for four out of five cases, while TikTok was heavily used to impersonate executives.
The report found that AI is being used primarily for deception rather than direct technical intrusion. Threat actors are deploying deepfake videos, cloned voices and AI applications to support romance scams, investment fraud and malware distribution.
Check Point advised organisations to prioritise business impact over incident volume, harden identity protections with phishing-resistant multi-factor authentication, audit internet-facing systems, strengthen third-party oversight and govern enterprise AI use.
It argued that a prevention-first approach to exposure management—identifying, prioritising and remediating the exposures most likely to enable consequential attacks—is essential in the AI era.
