A network of digital advocates is urging the Baguio City Government and concerned national agencies to immediately investigate the reported ransomware attack involving the City Government’s BUILDPass system.
Digital Pinoys National Campaigner Ronald Gustilo said the reported attack should be treated seriously, particularly following the city government’s confirmation that BUILDPass was taken offline after a reported ransomware incident that affected 2.9 GB worth of data.
“Whether the full claims of the ransomware group are eventually verified or not, there is clearly a security incident that needs to be investigated, as admitted by the Local Government of Baguio City in a statement. The people need to know what happened, how it happened, and whether government and personal data were compromised,” Gustilo said.
Gustilo also urged the Baguio City LGU to coordinate and submit the system to an investigation that may be conducted by the National Privacy Commission and the Cybercrime Investigation and Coordinating Center (CICC) to determine the extent of the attack.
Gustilo also said that the Baguio City Government has a responsibility to immediately provide affected residents and other stakeholders with accurate information about the incident.
“People who entrusted their personal information to the Baguio City Government deserve to know if their data was compromised. The City should not leave residents guessing or allow them to find out from a ransomware group or social media posts. The public deserves to know what information may have been affected, what the City is doing about it, and what people should do to protect themselves.”
Gustilo said that the incident should ultimately lead to accountability, particularly if the investigation establishes that negligence, inadequate security controls, or failures in oversight contributed to the breach.
“This is not simply an IT problem. This is a governance issue. The City Government was entrusted with the personal information of its constituents, and someone must be held accountable if there was a failure to properly protect it. Taking the system offline is only the first step. The people of Baguio deserve the truth, and if someone failed in their responsibility, there must be consequences.”
