Under Siege: The Cyberattacks Hitting the Philippines Amid WPS Tensions

This article's footnote has been updated on June 27 to include a message from the Embassy of the People's Republic of China in the Republic of the Philippines.

As Philippine vessels continue to face confrontations in the West Philippine Sea (WPS), another less visible battle is unfolding beyond the country's shores.

It is taking place in cyberspace.

In a February 2026 forum organized by Stratbase ADR Institute, Armed Forces of the Philippines Cyber Command chief Brigadier General Joey Fontiveros warned about China-based malicious actors who have carried out malware intrusions, distributed denial-of-service attacks, data leaks, and website compromises, amid tensions in the West Philippine Sea.

“The country's cybersecurity landscape in 2026 is characterized by escalating threats driven by geopolitical tensions, rapid digital transformation, and a sophisticated adversary environment, particularly from state-sponsored actors,” Fontiveros said in his speech, as reported by news outlets.

In 2025, foreign media have reported that China-based hackers had penetrated the Philippines' executive branch, where military data was stolen from 2023 to 2024. In 2024, the wires have likewise exposed that hackers operating in China attempted (but failed) to break into the email of the Department of Information and Communications Technology and the website of the National Coast Watch.

In a recent interview with Esquire Philippines, a cybersecurity expert and a former senior intelligence official both warned that cyberattacks targeting government agencies and critical infrastructure may be part of a broader contest for information, influence, and strategic advantage.

While proving the origins of cyberattacks remains notoriously difficult, Angel Redoble—founder of the Philippine Institute of Cyber Security Professionals (PICSPro) and former first vice president and chief information security officer of the PLDT Group, Smart Communications, and ePLDT Group—believes many of the incidents affecting the Philippines cannot be separated from the country's ongoing maritime dispute with China.

"We have seen attacks that appear closely related, although we cannot confirm them without deeper investigations," he said.

Among the incidents that raise concern are intrusions into government networks and critical infrastructure systems. Unlike ordinary cybercriminals who seek financial gain through extortion or ransomware, Redoble said state-sponsored actors are often motivated by intelligence gathering.

"The objective is information gathering," he explained. "They do not want you to know they are there."

That distinction is crucial because the information sought by foreign actors may have direct implications for national security, said Redoble, who was also a former cybersecurity consultant and lecturer to both private and government entities.

Among the incidents that concern cybersecurity experts are breaches involving government databases that contain sensitive information about citizens and state institutions. Redoble cited the reported compromise of the Philippine National Police's firearms database, arguing that such information could be highly valuable to foreign intelligence services.

"If a foreign nation-state operator gains access to that database, they can potentially know how many firearms we have, who owns them, and where those firearm owners live," he said.

Such information, he said, could help foreign actors build detailed profiles of individuals, institutions, and the country's security capabilities without ever setting foot on Philippine soil.

Cybercriminals typically announce their presence by encrypting files, demanding ransom payments, or stealing money. State-sponsored hackers, on the other hand, often seek to remain hidden for months or even years while collecting information that could be useful for strategic or political purposes.

Redoble cited attacks involving institutions that hold extensive information on Filipinos.

"If you are a foreign nation-state operator, that information is extremely important," he said, pointing to databases that contain information about citizens, government operations, and critical services.

Critical infrastructure, such as telecommunications networks, is particularly valuable because it can provide insight into communications patterns, organizational structures, and national capabilities.

"There is a very thin line between cybercriminal activities and cyberespionage activities," Redoble said. "But you can sometimes see the hand of foreign nation-state actors."

Redoble’s assessment echoes concerns raised by former National Intelligence Coordinating Agency deputy director-general Francisco Ashley Acedillo, who noted in a policy paper that state-sponsored cyber operations targeting the Philippine government, military, and critical infrastructure systems have increasingly focused on intelligence gathering and strategic advantage. 

The threat extends beyond intelligence collections, both experts said. It also includes efforts to shape perception and influence public discourse online.

The rise of cyber threats comes as Filipinos conduct their daily lives online.

Banking transactions, government services, communications, commerce, and social interactions now take place largely in cyberspace. According to Redoble, that reality has transformed cyberspace into a strategic domain where foreign actors can influence public opinion as effectively as they can infiltrate computer networks.

The spread of information—and disinformation—has become a critical component of modern geopolitical competition. Through social media platforms, coordinated messaging campaigns, and online influence operations, foreign actors can attempt to shape public perceptions of territorial disputes and national interests.

Redoble noted that many Filipinos now spend significant portions of their lives online, making cyberspace an attractive battleground for influence campaigns.

"The easiest way to propagate a false narrative is through cyberspace," he said.

He pointed to online content promoting narratives favorable to China and warned that coordinated efforts can amplify such messaging through networks of accounts and online supporters.

The battle for territory, he suggested, is accompanied by a battle for public opinion.

The tension in cyberspace, Redoble said, is not limited to hacking networks and stealing data. It also involves shaping public perception.

As more Filipinos rely on social media and digital platforms for news and information, cyberspace has become a crucial arena for competing narratives about the West Philippine Sea.

"If you want to control the narrative in the West Philippine Sea, you need to control Philippine cyberspace," he said.

Redoble warned that foreign actors can use online platforms, coordinated messaging campaigns, and networks of accounts to amplify narratives favorable to their interests. Such efforts, he said, can influence how Filipinos understand the country's territorial dispute with China.

He urged the public to be cautious about online content that contradicts the Philippines' internationally recognized claims in the West Philippine Sea.

"Atin ang West Philippine Sea," Redoble said. "Anyone, any group, any Facebook account, or any entity who says otherwise is not telling the truth."

Similar concerns have been raised by Acedillo.

He referred to a pattern of cyber activity that has evolved from malware and spear-phishing attacks against government and military networks to sophisticated advanced persistent threats (APTs) and distributed denial-of-service (DDoS) attacks.

Unlike conventional cyberattacks that seek immediate disruption or financial gain, advanced persistent threats are designed to quietly maintain long-term access to networks, allowing attackers to gather intelligence over extended periods. DDoS attacks, meanwhile, seek to overwhelm systems with internet traffic, rendering websites and online services inaccessible.

According to Acedillo, some of these incidents coincided with periods of heightened tensions in the West Philippine Sea, highlighting the growing intersection between cybersecurity and national security.

To him, cybersecurity is no longer merely a technical issue but a strategic imperative for national defense.

The challenge facing defenders has become more difficult as cyberattacks have grown sophisticated.

Having worked in cybersecurity for more than three decades, Redoble said he has witnessed a dramatic evolution in the capabilities of attackers.

In the early years of the Internet, many attacks were relatively simple and opportunistic. Today, he said, threat actors conduct detailed planning, study their targets extensively, and often possess advanced technical skills.

"Sometimes the attackers understand an organization's environment better than the people managing it," he said.

The emergence of artificial intelligence has further complicated the landscape. AI-assisted attacks can automate reconnaissance, craft convincing phishing messages, and identify vulnerabilities more efficiently than traditional methods.

"Defense is not getting better, but attackers are getting better every day," Redoble said.

He added that cybercriminals and state-sponsored operators continuously develop new techniques and exploit newly discovered vulnerabilities, while defenders often struggle to keep pace.

"The attackers are very innovative," he said. "The innovation of defenders often depends on technology vendors."

Redoble expressed concern about the Philippines' ability to defend itself against increasingly sophisticated cyber threats.

Building a comprehensive cybersecurity system requires significant investments in technology, skilled personnel, and continuous monitoring. Many organizations, he said, lack the resources necessary to establish a complete security ecosystem.

Even when resources are available, success depends heavily on the experience and expertise of those responsible for implementation.

"Cybersecurity is not just about buying technology," he said.

Instead, organizations need trained professionals capable of detecting threats, analyzing risks, and responding effectively to incidents.

The challenge extends beyond government institutions. Private companies, particularly those operating critical infrastructure, also play a vital role in national cybersecurity.

One problem, Redoble noted, is that many cyber incidents affecting private entities are never reported. Companies may fear reputational damage, regulatory scrutiny, or financial consequences if breaches become public.

As a result, government agencies may remain unaware of attacks that could have broader implications for national security.

Telecommunications firms, financial institutions, and other private organizations often possess information that is valuable not only to criminals but also to foreign intelligence services.

"If a private entity is hacked and does not report it, the government may never know," he said.

The increasing sophistication of cyber operations has also made it more difficult to determine where attacks originate and who may be involved in carrying them out.

Redoble also warned that some cyber operations linked to foreign interests may not necessarily be conducted from outside the country.

"There are Chinese state-sponsored threat actors operating inside the Philippines," he said, adding that foreign actors with strategic interests in the West Philippine Sea may seek both external and local avenues to conduct cyber operations.

Pointing to the period when Philippine Offshore Gaming Operators (POGOs) were active in the country, he said cybercrime and cyberespionage activities sometimes appeared to overlap, making it difficult to distinguish between criminal enterprises and state-linked operations.

He also raised the possibility that some Filipino threat actors could be working on behalf of foreign interests.

"I would not even be surprised if there are paid Filipino threat actors working for them," Redoble said.

If true, such arrangements would complicate efforts to identify the source of cyberattacks and could allow foreign-sponsored operations to blend more easily into the local digital environment.

For Redoble, cybersecurity should no longer be viewed as a purely technical concern.

A successful cyberattack against banking systems could disrupt economic activity. Compromises involving election systems could undermine public trust in democratic institutions. Attacks against telecommunications infrastructure could affect communications during crises.

The consequences, he argued, extend far beyond computer networks.

"It impacts national security, economic security, political security, and social security," he said.

History offers several examples of how cyber operations can produce real-world consequences. In 2007, a wave of cyberattacks disrupted government, media, and banking services in Estonia, one of the world's most digitally connected societies. In Ukraine, a 2015 cyberattack on power distribution companies left roughly 230,000 consumers without electricity for up to six hours, demonstrating how digital intrusions can produce immediate real-world consequences. Cyber operations have also been linked to the disruption of Iran's uranium enrichment program through the Stuxnet malware, which was discovered in 2010 and demonstrated how digital attacks could affect physical infrastructure and strategic national assets.

To strengthen the country's cyber defenses, Redoble advocates establishing a dedicated cybersecurity office at the highest levels of government, investing in talent development, and promoting the creation of locally developed technologies.

Rather than relying solely on imported technologies, he said the Philippines should cultivate its own cybersecurity capabilities.

"The government must shift from a consumer mindset to a creator mindset," he said.

For ordinary Filipinos, the stakes are far from abstract. Successful attacks on banks, telecommunications networks, government services, or election-related systems could disrupt daily life while undermining public trust in critical institutions.

As tensions persist in the West Philippine Sea, Redoble believes the Philippines must recognize that modern geopolitical competition extends beyond ships, coast guards, and contested waters.

The struggle is also taking place in digital networks, social media feeds, government databases, and critical infrastructure systems.

And in that battleground, cyberspace may prove to be one of the most important frontlines of all.

Esquire Philippines reached out to the Embassy of the People's Republic of China in the Republic of the Philippines via Viber for comment on June 18. This message was received on June 27:

"China is a staunch defender of cyber security and also a major victim of hacking. We stand firmly against and crack down on all forms of cyber attacks and crimes in accordance with law, and oppose politicizing cybersecurity issues. The virtuality of cyberspace makes it difficult to trace the source of actions, and the actors in cyberspace are diverse. It is neither professional nor responsible for relevant Philippine institutions to make judgments based solely on the targets and methods of the hacking attacks.

The article is entirely groundless and speculative. It relies on hearsay and interviews with certain individuals rather than verifiable evidence. The claim that 'many of the incidents affecting the Philippines cannot be separated from the country’s ongoing maritime dispute with China' is pure conjecture unsupported by facts.

This reflects a recurring tactic of certain media outlets: fabricating connections, distorting facts, and deliberately smearing China’s image. Such reporting seeks to inflame tensions between China and the Philippines, sensationalize maritime disputes, and undermine regional stability and mutual trust. Its bias and lack of professionalism clearly reveal an intention to sow discord rather than inform the public."

ALSO READ:

Opinion: We Thought We Were the Majority

Opinion: Panalo Mentality and Winning for Ego While the Country Pays

Opinion: How Disinformation Turns People Into Fanatics