GCash User Data Allegedly Sold on Dark Web, Company Releases Official Statement

TL;DR: A viral social media post is claiming that millions of GCash user records are being sold on a dark web forum.

A viral social media post is claiming that millions of GCash user records are being sold on a dark web forum.
The post cites a seller known as “Oversleep8351,” who is allegedly offering eKYC information, linked bank accounts, and GCash numbers from 2019 to October 2025, potentially affecting up to 7-8 …
The data reportedly includes personal details such as names, addresses, employment information, and valid Philippine IDs, with bundles priced as high as $25,000 and payable only via Monero cryptocu…
Users are advised to stay vigilant and to report suspicious activity only through official GCash channels, such as the GCash Help Center or hotline 2882.
GCash reiterates its dedication to protecting customer data and strengthening security, assuring the public that trust in their platform remains a top priority.

A viral social media post is claiming that millions of GCash user records are being sold on a dark web forum. The post cites a seller known as “Oversleep8351,” who is allegedly offering eKYC information, linked bank accounts, and GCash numbers from 2019 to October 2025, potentially affecting up to 7-8 million users. The data reportedly includes personal details such as names, addresses, employment information, and valid Philippine IDs, with bundles priced as high as $25,000 and payable only via Monero cryptocurrency. The listing describes the data as “unorganized” and available exclusively to buyers with a history of previous dark web transactions.

GCash has released an official statement addressing these allegations. According to GCash, there is no evidence of any data breach in their systems, and a preliminary forensic analysis has confirmed that their systems remain secure. GCash states that the alleged dataset does not match the data structure used in their records, contains many incomplete or invalid entries, and includes individuals who are not GCash users. Their investigation suggests the leaked material did not originate from GCash. The company assures customers that all accounts and funds are secure and emphasizes their ongoing commitment to user safety.

GCash is coordinating with authorities including the Bangko Sentral ng Pilipinas (BSP), National Privacy Commission (NPC), and the Cybercrime Investigation and Coordinating Center (CICC) to monitor and further investigate these allegations. Users are advised to stay vigilant and to report suspicious activity only through official GCash channels, such as the GCash Help Center or hotline 2882.

GCash reiterates its dedication to protecting customer data and strengthening security, assuring the public that trust in their platform remains a top priority.

Below is the official statement from GCash regarding this incident.

What data is allegedly being sold on the dark web?

The alleged data includes eKYC information, linked bank accounts, GCash numbers, names, addresses, employment info, and valid Philippine IDs from 2019 to October 2025.

Did GCash confirm a data breach?

GCash stated there is no evidence of a data breach, and a preliminary forensic analysis confirmed their systems remain secure.

What authorities is GCash coordinating with?

GCash is coordinating with the Bangko Sentral ng Pilipinas (BSP), National Privacy Commission (NPC), and Cybercrime Investigation and Coordinating Center (CICC).

React to this article: