Photo credit: Deep Web Konek

An alleged data breach involving Maxicare Philippines has been identified by the Deep Web Konek Team, exposing sensitive member information to potential misuse.

The breach, attributed to threat actor "OPCODE-90," involved the unauthorized scraping of authenticated data, compromising a file totaling 33.3 MB.

The breached data, reportedly up for sale to the first three buyers, includes over 22,800 lines of detailed personal and booking information. This includes sender details such as first name, middle name, last name, unit/vendor, company, email, and Go Rewards code.

Member details compromised include first name, middle name, last name, company name, 16-digit Maxicare card number, corp code, account type, date of birth, sex, mobile numbers, email address for schedule confirmation, other remarks, and VIP status.

Additionally, member booking details such as province, country, ZIP code, city, barangay, street, village/subdivision, landmark, preferred dates and times, and requested procedures were exposed.

The breach has affected over 1,000 major companies, including ABS-CBN Corporation, Accenture, Inc., Acer Philippines Inc., and many others.

Maxicare Philippines issued a notification on June 16, 2024, to affected members regarding the breach, which occurred on June 13, 2024. The unauthorized access was gained through Lab@Home, a third-party provider for laboratory requests from home. Although Lab@Home operates a separate database not integrated with Maxicare's systems, the breach has nonetheless impacted Maxicare members.