The facts
St. Luke's said it identified unauthorised access on 29 October to a third-party platform that supports its mobile application. It said some patients' and employees' personal information may have been affected. [1][2][3]
The hospital said it implemented containment measures, engaged independent cybersecurity experts and would notify people whose information may have been involved. It said hospital operations remained unaffected. [2][3]
The National Privacy Commission confirmed to GMA News on 3 November that it received the hospital's notification on 30 October and was reviewing it under its established procedures; the commission said it could not disclose more during that review. [2][3]
Still unconfirmed
- The number of people affected, the specific personal information involved, whether information was accessed or removed, the cause or actor, and the results of the investigation.
Sources
References support the numbered facts above. Source checks: 3 Nov 2026, 12:30 UTC.
The hospital's official notice page was opened but exposed only its title and date; GMA and PhilSTAR Life quote the notice, and GMA directly obtained the regulator's response. Both are independently owned reporting hosts but reference the same hospital notification. No claim is made that records were exfiltrated or that core clinical systems were accessed; scope remains unknown.
- Notice on a Data Security Incident
St. Luke's Medical Center · Primary source · 30 Oct 2026
Opened the hospital's notice page, which displayed the notice title and 30 October date but not its body. Substantive statements are attributed to the hospital in the reporting sources below.
- St. Luke's Medical Center probing data security incident on mobile app
GMA News · Reporting · 3 Nov 2026
Opened report updated 3 November. GMA obtained the National Privacy Commission's confirmation and quoted the hospital's 30 October notice.
- NPC investigates personal data breach at St. Luke's Medical Center
The Philippine Star / PhilSTAR Life · Reporting · 3 Nov 2026
Opened separate report quoting the commission's review and the hospital's statement. It reports the same notice, not independent forensic confirmation.