On March 27, 2016, hackers identifying as Anonymous Philippines defaced the Commission on Elections (COMELEC) website, warning that security around vote-counting machines was inadequate ahead of the May 9 general election. Later that day, LulzSec Pilipinas published links claiming to expose the commission’s database; the leaked material reportedly totaled 340 gigabytes. Trend Micro estimated that up to 55 million registered voters were at risk, including 1.3 million overseas voters’ passport numbers and expiry dates and 15.8 million fingerprint records. A searchable site, wehaveyourdata, subsequently made voter information publicly accessible before being taken down with assistance from the U.S. Department of Justice.
COMELEC chairman Andres Bautista disputed whether the exposed material was authentic or confidential and said the breach would not compromise the election because vote-counting machines used separate servers. The National Bureau of Investigation arrested Paul Biteng on April 20, 2016, and Joenel de Asis eight days later; authorities said Biteng defaced the site while de Asis downloaded and distributed the database, though both men disputed some allegations. A third suspect remained unidentified. On December 28, 2016, the National Privacy Commission ruled in case 16-001 that COMELEC violated the Data Privacy Act of 2012 and recommended criminal prosecution of Bautista, establishing regulatory accountability for the security failure.
