The DICT reported an incident involving its eComplaints system, a third-party service linked to the eGov PH platform, where over 30,000 complaint records were allegedly exposed. The department clarified that the eGov PH app itself was not compromised, and the breach was isolated to the eComplaints system, which operates separately from the main infrastructure. DICT emphasized that no personal data on the eGov platform was leaked, as it remains encrypted and protected by cybersecurity measures. While the exact nature of the exposed records (e.g., whether they contained sensitive personal or financial details) was not confirmed, the incident raised concerns about third-party vulnerabilities in government digital services. DICT committed to providing updates as further verified information becomes available, reiterating its priority to safeguard citizen privacy. The incident did not result in a full-scale breach of the primary eGov PH system, but the exposure of complaint records—even if non-sensitive—could still undermine public trust in digital governance platforms.

The DICT’s eGov ‘super app’ and its eLGU platform—used by 14 million Filipinos and 924+ local government units (LGUs)—were deployed without signed contracts (MOAs/MOUs) defining data protection responsibilities, breach reporting, or liability. An internal audit (2025) revealed 40 out of 85 eLGU-adopted LGUs had no agreements, while 474 out of 973 iBPLS-adopted LGUs lacked complete MOAs, exposing unclear accountability for data breaches. The system collects excessive personal data upfront (government IDs, live photos, signatures, addresses) even for basic services like viewing health centers, raising proportionality concerns under privacy laws. The absence of Data Sharing Agreements (DSAs) or formal policies leaves no clear recourse for citizens in case of breaches, despite routine hacking incidents (e.g., 19 government sites hacked in September 2025 protests). DICT claims no data is stored or shared via eGovDX APIs, but experts warn this creates legal ambiguity, risking COA disallowances for irregular spending (e.g., ₱377.64M in contracts without enforceable agreements). Former NPC officials highlight the government’s poor track record in breach accountability, citing unresolved cases like the 2016 Comelec hack. The platform’s lack of transparency and unmitigated risks undermine trust in a system handling sensitive citizen data at scale.