Ransomware claims in the Philippines already passed the last two years combined. 7 basics every office should have

In October, Check Point published its 2026 threat landscape report for the Philippines. Covering January to August 2026, it counted 31 public ransomware claims against Philippine organizations. That is already more than the 26 claims recorded across 2024 and 2025 combined, with four months of the year still to go.

Ransomware is the attack where criminals lock or steal your files, then demand payment. "Public claims" are the cases where a criminal group announced the victim on its leak site, so the real number of attacks is likely higher.

What the report found

• More groups are active here. Fifteen ransomware groups posted Philippine victims this year, and ten of them appeared in the local data for the first time. The most active, Qilin, accounted for about 29% of claims.
• Many sectors were hit for the first time. Business services, government, transportation, education, technology and others recorded claims in 2026 after none in the same period of 2025.
• Government saw the most incidents overall. Government agencies had 72 of the 264 incidents tracked, mostly website defacements and system disruptions. Financial institutions had the highest share of serious cases such as ransomware and data leaks.
• Stolen passwords matter more than clever hacking. Information-stealing malware, which quietly copies saved passwords from infected computers, was behind almost 44% of the exposed-data cases. The report also notes 2,386 phishing alerts during the period.

The takeaway: attackers aren't mostly using brand-new techniques. They're getting in with stolen logins, tricked staff, and systems left open to the internet.

Seven basics for a typical office

You don't need a security department to make yourself a much harder target. These seven steps cover most of what the report describes.

1. Turn on two-step login everywhere it's offered

Email, cloud storage, accounting software, remote access, and social media pages. A stolen password alone is far less useful when the attacker also needs a code from your phone.

2. Close or protect anything open to the internet

Remote desktop, old VPN boxes, NAS drives with remote access turned on, and admin pages of routers. If you don't need it reachable from outside, turn it off. If you do, put it behind a VPN with two-step login and keep it updated.

3. Keep backups the attacker can't reach

Ransomware often deletes or encrypts backups too. Keep at least one copy offline or in cloud storage with versioning, and test a restore every few months. A backup you've never restored is a hope, not a plan.

4. Don't let browsers save work passwords on shared PCs

Information stealers go straight for passwords saved in browsers. Use a password manager instead, and don't log in to work accounts on shared or personal computers that nobody maintains.

5. Remove old accounts

Former staff, old interns, test accounts and the shared "admin" login everyone knows. Each one is a door. Review accounts at least twice a year and whenever someone leaves.

6. Keep everything updated

Windows, browsers, routers, firewalls and NAS devices. Turn on automatic updates where you can, and replace devices that no longer receive updates.

7. Write a one-page "what to do if" plan

Who to call, which computers to disconnect first, where the backups are, and who talks to clients. If personal data may be involved, the Data Privacy Act has notification rules with tight deadlines, so decide in advance who handles that.

Where to start this week

If you only do two things: turn on two-step login for email, and check that you have one backup copy that isn't permanently connected to your network. Those two steps alone would have blunted many of the attacks behind these numbers.

If you'd like a second pair of eyes, our security check-up looks at exactly these points and gives you a short list of fixes, worst first.