Cyber Incident Victim: ABS-CBN
Date:
Aug 2018
Location:
Philippines
Summary
A major Filipino broadcaster experienced a financial data breach when malware embedded in its online store's JavaScript file intercepted customer payment card details during checkout. The stolen information was transmitted to servers in Russia, with the skimmer operating for several weeks before detection. Security researchers confirmed the malicious code remained active at the time of discovery and had targeted customers purchasing merchandise. The company later acknowledged the incident, estimating 213 individuals might have been affected, and temporarily shut down the compromised e-commerce platforms while emphasizing the breach was isolated to specific store websites.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
The ABS-CBN data breach was discovered by Dutch security researcher Willem de Groot, who identified a payment skimmer operating within the Filipino broadcaster's online store. The malware, embedded in an obfuscated JavaScript file on the store's website, had been active since at least August 16, 2018, and remained unchanged for four weeks prior to detection. This skimmer intercepted customers' payment card details during the checkout process when purchases were made through the ABS-CBN Store and UAAP Store websites. The stolen financial data was transmitted to a server associated with the domain adaptivecss.org, which was hosted on a Russian network in Irkutsk. This network was also linked to coffeemokko.com, a domain previously connected to other malware campaigns uncovered by de Groot. Google Chrome flagged the affected online store as insecure at the time of discovery, though the exact method of initial compromise remained unspecified. De Groot attempted to notify ABS-CBN about the breach but received no immediate response.
On September 19, 2018, ABS-CBN confirmed the incident was under investigation and temporarily shut down both affected store websites. The company stated the breach was isolated to these two e-commerce platforms, with no impact on other digital properties. ABS-CBN estimated 213 customers may have had their financial data compromised during the skimmer's operation. The broadcaster characterized the incident as a theft of payment card information but did not disclose technical specifics about how the malware was deployed or whether additional personal data was accessed. In a public statement, ABS-CBN emphasized its commitment to customer privacy and security, pledging to implement measures to prevent future breaches. The duration of the skimmer's activity and its connection to known malicious infrastructure suggested a coordinated attack, though no threat actor claimed responsibility.