Hackers Stole Nuclear Blueprints From the Philippines Using Flaws Fixed Two Years Ago
Researchers found nearly 1.2 gigabytes of stolen data on a server in Amsterdam, including reactor component databases, fuel records, and passport files belonging to Filipino government scientists.
Key points
- Hackers broke into a Philippine nuclear agency and a naval shipbuilding contractor, stealing at least 372 megabytes of confirmed victim data and possibly as much as 9 gigabytes in total.
- Researchers at threat-hunting firm Hunt.io found the stolen files sitting on a server in Amsterdam on 26 August 2025.
- Both breaches exploited software flaws that had been publicly known and fixable for more than two years.
- Folder names and code comments on the hackers' server were written in Chinese, though Hunt.io stopped short of naming a specific country or group.
- Breach incidents in the Philippines nearly tripled in the first half of 2026 compared with the same period in 2025, according to Vietnam-based cybersecurity firm Viettel Security.
Somewhere in the Philippines, a government nuclear agency was running software with a known hole in it. The hole had been reported, fixed, and publicly documented in November 2023. Nobody patched it. And so, more than two years later, hackers walked straight through it.
Researchers at Hunt.io, a firm that scans the internet for signs of criminal activity, stumbled on the aftermath. They found a server rented in Amsterdam that appeared to be the hackers' staging post, a place to store stolen files and hacking tools. On it sat 1,310 files totalling nearly 1.2 gigabytes.
What was actually stolen?
The confirmed victim data is detailed and sensitive. Hackers took a reactor core-component database, historical fuel inventories, radiation safety manuals, and authorised-user lists from the nuclear agency. Personnel folders contained resumes, passport scans, foreign travel records, and Philippine government financial disclosure forms that public officials are required to file.
A spreadsheet named after the nuclear agency's parent ministry suggested a far larger haul. Up to 9 gigabytes may have left the agency's network entirely, though Hunt.io researcher Esteban Borges says the firm cannot confirm that figure with certainty. A valid login credential for the agency's own cloud storage system was also recovered, meaning re-entry would have been trivial.
The second victim, a marine engineering and shipbuilding company that works with the Philippine Navy, was also identified in the files. Documents recovered from that breach could allow the hackers to break back in, Borges warned.
How did the hackers get in?
Two old, patched software flaws were the way in. The first was CVE-2023-49105, a flaw in ownCloud, which is open-source software that lets organisations run their own private file-sharing service (think of it like a self-hosted Dropbox). This flaw lets an attacker bypass the login check entirely, using a feature meant to allow quick file access. It was disclosed and fixed in November 2023.
The second was CVE-2024-28000, a flaw in a popular WordPress plugin called LiteSpeed Cache, patched in August 2024. WordPress is the software that powers roughly a third of all websites worldwide; plugins are small add-ons that extend its features.
| Flaw | Software affected | Disclosed | Patched | Still exploited |
|---|---|---|---|---|
| CVE-2023-49105 | ownCloud file sharing | Nov 2023 | Nov 2023 | Yes, 2+ years later |
| CVE-2024-28000 | LiteSpeed Cache (WordPress) | 2024 | Aug 2024 | Yes, months later |
The failure mode here is as old as IT itself: a known fix existed, and nobody applied it to internet-facing systems belonging to one of the most sensitive institutions in the country.
Should ordinary Filipinos be worried?
Direct public risk is low right now. Hunt.io found no evidence the hackers tampered with systems that actually control the nuclear reactor or the shipyard. "Everything we saw is collection and exfiltration, no disruption tooling," Borges said.
The real concern is the people named in those personnel files. Government scientists and naval contractors whose passport details, travel records, and financial disclosures are now in unknown hands should watch for targeted phishing, where criminals send fake emails designed to trick a specific person using details only someone close to them should know. If you work in a Philippine government agency and receive unexpectedly personalised emails asking you to log in somewhere or open an attachment, treat it as suspicious.
Borges put the prevention case bluntly: patch internet-facing software, change default security keys, and require strong two-step login verification on all administrative accounts. In practice, those three steps would have stopped this entirely.
One thing the post-mortem will say: the door was unlocked, the key was under the mat, and the sign saying so was public for two years.
