The Department of Public Works and Highways (DPWH) in the Philippines faces a dual crisis: an alleged data leak by an underground forum handle ‘KANLAON’ claiming exposure of 231,761 document lines and 32,125 API entries, including credentials, emails, addresses, and database artifacts—potentially linked to ₱306M ‘ghost’ flood-control projects in Negros. While the leak remains unverified, it poses risks of phishing, identity theft, and fraud targeting citizens, employees, and contractors. Separately, confirmed investigations reveal systemic corruption, with DPWH’s former chief acknowledging ghost projects in Bulacan, Senate probes, and executive actions including an independent investigative body and sanctions against erring contractors. Operational lapses, such as a DPWH engineer admitting failure to inspect projects, underscore governance failures. The leak, if validated, could exacerbate reputational damage, financial fraud, and public distrust, while the ghost projects alone demand accountability reforms. The situation highlights vulnerabilities in public-sector cybersecurity and procurement integrity.