THE Securities and Exchange Commission (SEC) said initial findings showed that its internal database infrastructure and system integrity remain intact following a data security incident detected on Nov. 6.
In a statement released late Monday, SEC said “that no passwords were leaked and no data had been modified or altered.”
However, the commission acknowledged that individual profile information may have been exposed, although it is still verifying the origin, scope and validity of the potentially affected records.
The SEC said it immediately activated containment and preventive measures upon discovering the incident, including security scans, digital forensic examinations and analyses of system logs to determine whether its digital infrastructure had been accessed without authorization.
It also reinforced access controls, updated authentication credentials and conducted data integrity checks to ensure that corporate records remained secure.
Additional technical safeguards and monitoring measures have since been implemented to address potential vulnerabilities and prevent a recurrence.
The SEC said it formally notified the National Privacy Commission of the incident on Nov. 9, in compliance with mandatory reporting requirements.
It has also intensified monitoring of its digital services to detect and block suspicious account activity and introduced additional verification checks for account-related requests and security updates.
The commission urged users to change passwords shared across multiple online accounts, enable two-factor authentication where available and avoid disclosing their login credentials, one-time passwords and email verification links.
It also advised the public to scan their computers and mobile devices for potential security threats and monitor their accounts for unusual transactions, login alerts or suspicious communications.
The SEC emphasized that it would never ask users for their passwords or security PINs.
Cease and desist
Meanwhile, SEC has ordered online lending platform Peso Flow to stop its financing activities after finding that it used the corporate identity of a registered financing company without authorization.
In an order dated Oct. 30, the SEC’s Financing and Lending Companies Department (FinLenD) directed Peso Flow’s operators to immediately cease and desist from engaging in, promoting or facilitating financing and lending activities without the required regulatory authority.
The order also covers the platform’s owners, officers, representatives, service providers and other persons acting on its behalf.
The commission said Peso Flow was prohibited from claiming any ownership, operational or other affiliation with Sofi Financing Inc., a financing company registered with the SEC.
It also directed the platform to take down its website, digital platforms and other online channels, including mobile applications and social media accounts used to offer and facilitate its financing services.
The SEC action followed a formal complaint filed by Sofi Financing, which denied any affiliation with Peso Flow and said its official lending platform was Finbro.ph.
An investigation by FinLenD found that Peso Flow had not secured a certificate of authority from the commission to operate as a financing company, as required under Republic Act 8556, or the Financing Company Act of 1998.
The investigation also found that Peso Flow and its operators were not authorized representatives, agents, third-party providers or digital channels of Sofi Financing.
