Hackers Stole Nuclear Blueprints From the Philippines Using Flaws Fixed Two Years Ago
Researchers found nearly 1.2 gigabytes of stolen data on a server in Amsterdam, including reactor component databases, fuel records, and passport files belonging to Filipino government scientists.
Key points
- Hackers broke into a Philippine nuclear agency and a naval shipbuilding contractor, stealing at least 372 megabytes of confirmed victim data and possibly as much as 9 gigabytes in total.
- Researchers at threat-hunting firm Hunt.io found the stolen files sitting on a server in Amsterdam, in a blog post published on 26 August 2025.
- Both breaches exploited software flaws that had been publicly known and patchable for more than two years.
- Folder names and code comments on the hackers' server were written in Chinese, though Hunt.io stopped short of naming a specific country or group.
- Breach incidents in the Philippines nearly tripled in the first half of 2026 compared with the same period in 2025, according to Vietnam-based cybersecurity firm Viettel Security.
Somewhere in the Philippines, a government nuclear agency was running software with a known hole in it. The hole had been reported and fixed in November 2023. Nobody patched it. More than two years later, hackers walked straight through it.
Researchers at Hunt.io, a firm that scans the internet for signs of criminal activity, found the aftermath: a server rented in Amsterdam that appeared to be the hackers' staging post. On it sat 1,310 files totalling nearly 1.2 gigabytes. We covered the initial discovery on 28 August 2026 in "Chinese-Speaking Hackers Hit Philippine Nuclear Research Agency Through ownCloud Bug"; this story goes further into what was taken and how.
What was actually stolen?
The confirmed victim data is detailed and sensitive. Hackers took a reactor core-component database, historical fuel inventories, radiation safety manuals, and an authorised-user list from the nuclear agency. Personnel folders contained resumes, passport scans, foreign travel records, and Philippine government financial disclosure forms that public officials are required to file.
A spreadsheet named after the nuclear agency's parent ministry suggested a far larger haul: up to 9 gigabytes may have left the agency's network entirely, though Hunt.io researcher Esteban Borges says the firm can't confirm that figure. A valid login credential for the agency's own ownCloud instance was also recovered, meaning re-entry would've been trivial.
The second victim, a marine engineering company that works with the Philippine Navy, was also identified. Documents from that breach contain details that could allow the hackers to break back in, Borges warned.
How did the hackers get in?
Two old, patched software flaws were the way in. The first was CVE-2023-49105, a flaw in ownCloud, open-source software that lets organisations run their own private file-sharing service. This flaw lets an attacker bypass login entirely through a feature meant to allow quick file access via pre-signed URLs. Disclosed and patched in November 2023.
The second was CVE-2024-28000, a flaw in the LiteSpeed Cache plugin for WordPress, patched in August 2024. WordPress powers roughly a third of all websites worldwide; plugins are add-ons that extend its features.
| Flaw | Software affected | Patched | Still exploited |
|---|---|---|---|
| CVE-2023-49105 | ownCloud file sharing | Nov 2023 | Yes, 2+ years later |
| CVE-2024-28000 | LiteSpeed Cache (WordPress) | Aug 2024 | Yes, months later |
The failure mode is as old as IT itself: a known fix existed, and nobody applied it to internet-facing systems belonging to one of the most sensitive institutions in the country.
Should ordinary Filipinos be worried?
Direct public risk is low right now. Hunt.io found no evidence the hackers tampered with systems that actually control the nuclear reactor or the shipyard. "Everything we saw is collection and exfiltration, no disruption tooling," Borges said.
The real concern is the people named in those personnel files. Government scientists and naval contractors whose passport details and financial disclosures are now in unknown hands should watch for targeted phishing, where criminals send fake emails using details only an insider should know. If you work in a Philippine government agency and receive unexpectedly personalised emails asking you to log in somewhere or open an attachment, treat it as suspicious.
Borges put the prevention case plainly: patch internet-facing software, change default security keys, and require multifactor authentication on all administrative accounts. Those three steps would've stopped this entirely.
Hunt.io didn't name a Chinese state group. "Language is one of the easiest indicators to plant," Borges said. "We're not saying this is a false flag, but we can't rule one out on language alone." That's the honest call. What's harder to explain away is that the door was unlocked for two years, the method was documented publicly, and whoever came through it knew exactly what to take.
