Cybersecurity Alert: Massive Data Breach Claims at MyBusybee Could Expose 160 Million Users in the Philippines

An Alert That Shakes the Telecom Industry

In recent hours, the international cybersecurity community has been put on alert following a tweet from analyst VECERT Radar (@VECERTRadar), who reported a suspected massive data leak against MyBusybee, a messaging and SMS platform used in the Philippines. According to the message, the threat actor known as 'duoduomiliao' claimed to have compromised the company's database, with a volume of 60 GB of sensitive information.

The incident, classified as a CTI ALERT (Cyber Threat Intelligence), is currently UNCONFIRMED. However, the magnitude of the compromised data, which would include 160 million users and 2,500 companies, has sparked widespread concern both in the Asian country and the region.

The Exposed Data: A Treasure Trove for Cybercrime

According to the alert, the compromised information would not only include names and phone numbers but also SMS content and OTP codes (One-Time Passwords). OTPs are single-use keys sent via text message to authenticate banking transactions or account access. If these codes fall into the wrong hands, attackers could intercept security verifications, increasing the risk of financial fraud and identity theft.

The list of those affected would be enormous:

• 160 million users (nearly the entire Philippine population, which exceeds 115 million, suggesting possible duplicate data or data from other countries).
• 2,500 companies using the platform for their communications.
• 60 GB of data, a considerable volume that would include complete databases.
• SMS content and OTPs, making it a risk to users' financial security.

What Does This Mean for Users?

Although the breach has not yet been verified by the company or local authorities, security experts recommend acting with caution. If the data is real, MyBusybee users could be victims of:

• Phishing (identity spoofing to obtain more information).
• SIM swapping (duplicating a SIM card to receive verification SMS).
• Credential stuffing attacks (using leaked passwords on other services).

The immediate recommendation is to change passwords on linked accounts, enable two-factor authentication (2FA) that does not rely on SMS, and be wary of any suspicious communication requesting personal information.

The Modus Operandi of the Actor 'duoduomiliao'

The attacker, who goes by the name duoduomiliao, is a user of hacking forums and has posted on Breached, a clandestine forum known for being a marketplace for stolen data. In their message, the actor claimed to have complete access to MyBusybee's database and offered a sample of the data to prove its authenticity. This is a common practice in cybercrime: first publish a sample, then sell or release the full database if the company does not pay a ransom or if they want notoriety.

The posting on Breached, a site that has been used in attacks on major corporations like X (Twitter), Uber, and Robinhood, lends some credibility to the threat, although researchers typically treat such claims with skepticism until a verified sample is available.

Reactions and Next Steps

As of now, MyBusybee has not issued an official statement regarding the suspected breach. The company, with offices in Manila, has remained silent on its social media channels. Philippine authorities, through the Department of Information and Communications Technology (DICT) and the CERT Philippines, have not publicly responded to the alert.

Meanwhile, the VECERT Radar team recommends that companies using SMS services (especially the 2,500 mentioned) audit their security protocols and consider rotating keys and access tokens. For users, the advice is clear: do not share OTP codes with anyone and be suspicious of any request for personal information via text message.

The investigation is ongoing. From Imago, we will continue to follow this case closely, which could become one of the most significant cyberattacks of the year in Southeast Asia. In the meantime, the recommendation remains the same: prevention is the best defense.

Sources: VECERT Radar (Twitter), Breached forum, CERT Philippines.