Philippine Savings Bank (Metrobank Group) Listed by qilin Ransomware Group

On January 28, 2026, Philippine Savings Bank, part of the Metrobank Group, appeared on the leak site of the qilin ransomware group. The attackers claim to have stolen internal files during a ransomware incident. While the total number of customers affected remains unknown, anyone with an account at the bank could have personal or financial details now at risk of exposure.

Reported Details from Reporting

Public reporting indicates that qilin listed Philippine Savings Bank on its data leak portal and posted samples of allegedly stolen material. The bank has not yet issued a detailed public statement confirming the breach scope or the exact data involved. Available information describes the exposed material as internal files exfiltrated during the ransomware attack. No confirmed count of affected records has been released.

Why This Matters for You and Your Family

When a bank suffers a breach, the information at stake often includes names, addresses, government identification numbers, account details, and transaction records. Criminals can use these to attempt identity theft, open fraudulent accounts in your name, or file fake tax returns. For families, a single leak can expose shared addresses, joint accounts, or children’s records that appear in parent files. Once data leaves the bank’s control, you and your family bear the long-term consequences of monitoring, disputes, and potential fraud.

Credential leaks like this one frequently cascade into account takeovers on other services where the same email or password is reused.

The Doxxing and Identity-Chain Risks

Stolen internal files can contain email addresses, phone numbers, and customer reference details that link multiple accounts together. Attackers routinely combine these fragments with data from earlier breaches to build a complete identity chain. What begins as a bank leak can lead to doxxing attempts, targeted phishing, or harassment that reaches your home, workplace, or children’s online profiles. Gaming accounts belonging to teenagers are especially vulnerable because kids often reuse credentials or recovery email addresses tied to family data.

Qilin Ransomware Group’s Known Track Record

Public reporting attributes the attack to the qilin ransomware group. The group emerged in 2022 and has targeted organizations across multiple countries with a double-extortion playbook: encrypt victim systems, exfiltrate data, then threaten to publish the files unless a ransom is paid. Notable prior victims include healthcare providers, manufacturers, and financial institutions. Qilin typically posts samples and deadlines on its leak site before releasing larger data dumps if demands are not met.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what chains back to the Philippine Savings Bank breach.
• Rotate any password you used at Philippine Savings Bank anywhere else it appears, then enable two-factor authentication through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your information is caught in hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts, which often become entry points when credential leaks cascade into doxxing chains.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The incident shows that even established banks can be forced to confront sudden data exposure with limited public information available at first. Acting quickly on the credentials and linkages you control remains the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to gain clear visibility and expert support before the next wave of misuse begins.