GCash denies data breach claims, cites inconsistent data

GCash has denied a data breach after reports of user data, including account numbers, linked bank accounts, and KYC records, being sold on the dark web.

The company, operated by G-Xchange Inc., stated that preliminary analysis shows the circulated data includes non-GCash users and incomplete, inconsistent, or invalid entries, suggesting it did not originate from GCash.

GCash assured customers that their funds and personal information remain secure, as their internal investigation found no evidence of a breach into critical systems.

The National Privacy Commission (NPC) has launched an investigation into the alleged breach and advised users to exercise heightened vigilance.

GCash is collaborating with the Bangko Sentral ng Pilipinas (BSP), NPC, and Cybercrime Investigation and Coordinating Center (CICC) to further validate information and protect its systems.