Table of Contents
Key Takeaway
- 🔑 The Bill: House Bill 9605, the National Cybersecurity and Critical Information Infrastructure Protection Act of 2026, passed second reading on August 4, 2026, sponsored by Reps. Miguel Luis Villafuerte and Brian Poe.
- 🛡️ What It Creates: A National Cybersecurity Agency (NCSA) — the Philippines’ first centralized cybersecurity authority, covering banking, telecom, energy, health, transport, water, and broadcast media as critical infrastructure.
- 📊 The Threat: 16,619 phishing attacks, 255 data breaches, and 19.2 million compromised credentials hit the Philippines in H1 2026 alone — while the country still has no cybersecurity law.
- 🏛️ The Gap: The Philippines currently relies on DICT issuances and a 2023 executive plan — not legislation. HB 9605 would give cybersecurity enforcement the force of law for the first time.
- ⚡ What You Should Do: Filipino professionals and business owners should track this cybersecurity bill Philippines is debating, assess their own compliance readiness, and prepare for mandatory breach reporting if it passes.
The cybersecurity bill Philippines desperately needs has arrived. The Philippines has been fighting a cyberwar with no legal ammunition. That is not a metaphor. It is the literal state of the country’s digital defenses in 2026: a nation that recorded 16,619 phishing attacks in six months, suffered the defacement of both the Senate and House of Representatives websites within the same week, and watched 19.2 million user credentials get compromised — all while operating without a single cybersecurity law on the books. The cybersecurity bill Philippines is now debating, House Bill 9605, represents the most serious legislative attempt to close that gap. But the question worth asking about this cybersecurity bill Philippines is debating is not whether it will pass. It is whether it comes soon enough to matter.
What follows is an analysis of why HB 9605 emerged when it did, what it actually does, and what it means for the Filipino professionals, entrepreneurs, and IT workers who will live under its framework — assuming Congress moves before the next major attack does.
Why the Cybersecurity Bill Philippines Is Happening Now
Timing in legislation tells a story. The cybersecurity bill Philippines needs did not surface in a vacuum. It surfaced after a sequence of events that made inaction politically impossible.
On June 10, 2026, a hacktivist collective called Nullsec Philippines defaced the official website of the Senate of the Philippines at 11:30 p.m., altering its contents and leaving a message demanding government accountability. Three days later, on June 13, the House of Representatives website suffered the same fate. The DICT Cybersecurity Bureau confirmed both incidents, noting that while no confidential data appeared compromised, the defacements violated the Cybercrime Prevention Act of 2012 (Republic Act No. 10175). These were not isolated events. The House website had been defaced before, in 2023, and in September 2025 alone, the DICT confirmed 1.4 million hacking attempts on government websites in a single weekend, with 19 government sites successfully breached — including the DICT’s own website.
Rep. Brian Poe, co-sponsor of HB 9605, made the connection explicit during his sponsorship speech. “Cybercrime is no longer an isolated or occasional threat. It has become organized, industrialized, and increasingly sophisticated,” Poe said. He warned that criminals now exploit artificial intelligence, cloud technologies, and digital platforms to scale their attacks — a reality visible in the 16,619 phishing attacks recorded nationwide in the first half of 2026, according to Viettel Cyber Security’s Cyber Threat Landscape Report. That same report documented 255 data breach incidents exposing approximately 335 million records and 2.6 terabytes of data.
His co-sponsor, Rep. Miguel Luis Villafuerte, framed the stakes even more bluntly: “The question is no longer whether the country will experience another major cyberattack. The question is whether we are prepared when it happens.”
That is the political pressure that produced HB 9605. But the threat landscape predates these specific attacks by years.
What the Numbers Reveal — and What They Miss
The statistics tell a story of escalation. In 2025, Viettel Threat Intelligence recorded 266 data breach incidents in the Philippines, compromising approximately 228 million credentials and 1,382 gigabytes of data. Surfshark separately reported 1.3 million breached Filipino accounts that year — roughly three per minute. Ransomware attacks reached 22 documented incidents. And according to BlueVoyant’s 6th Annual Supply Chain Security Insights report, 100 percent of organizations in the Philippines experienced cybersecurity incidents linked to supply chain vulnerabilities.
Here is what those numbers miss: the cost of not having a law. The Philippines cybersecurity market reached $282.68 million in 2026, according to Mordor Intelligence, growing at 8.10 percent annually toward $417.12 million by 2031. The government’s National Cybersecurity Plan 2023-2028 sets milestones for workforce development, threat detection, and incident response. The DICT issued mandatory third-party cybersecurity testing requirements for critical digital systems starting February 2, 2026. South Korea’s KOICA committed $25.6 million to build a National Cyber Security Center in the Philippines through 2029.
All of these measures — the spending, the plans, the executive orders, the international partnerships — operate without the backing of a cybersecurity law. They are policy, not statute. They can be rewritten by the next administration, defunded in the next budget cycle, or ignored by the agencies they nominally govern. The cybersecurity bill Philippines is debating would change that by creating an agency with statutory authority, mandatory compliance standards, and legal consequences for failure.
| Metric | Value | Source |
|---|---|---|
| Phishing attacks (H1 2026) | 16,619 | Viettel Cyber Security |
| Data breaches (H1 2026) | 255 incidents | Viettel Cyber Security |
| Compromised credentials (H1 2026) | 19.2 million | Viettel Cyber Security |
| Supply chain incidents | 100% of PH organizations | BlueVoyant 2026 |
| PH cybersecurity market (2026) | $282.68 million | Mordor Intelligence |
| KOICA investment | $25.6 million (2025-2029) | KOICA Philippines |
What HB 9605 Actually Does
The cybersecurity bill Philippines is considering does three things that no existing policy or executive order currently does with the force of law.
First, it establishes the National Cybersecurity Agency (NCSA) as the central authority for cybersecurity policy, national coordination, and critical information infrastructure protection. Under the current setup, cybersecurity responsibilities are scattered across the DICT’s Cybersecurity Bureau, the National Computer Emergency Response Team (NCERT), the Cybercrime Investigation and Coordinating Center (CICC), and the National Privacy Commission (NPC). Poe described the existing framework as one that leaves the country in a “fragmented and reactive cybersecurity posture” — and the NCSA is designed to move it toward one that is “coordinated, proactive, and resilient.”
Second, the bill defines Critical Information Infrastructure (CII) and brings it under mandatory protection. Based on the related House Bill 7359, which shares the same legislative lineage, CII covers eight sectors: banking and finance, broadcast media, emergency services and disaster response, energy, health, telecommunications, transportation (land, sea, air), and water. Any entity — public or private — that owns, operates, or maintains infrastructure in these sectors would be subject to the NCSA’s standards. This is the provision that makes the cybersecurity bill Philippines is debating directly relevant to private businesses, not just government agencies.
Third, the bill mandates data breach reporting. Government institutions, government-owned corporations, private companies, and business establishments operating in the Philippines would be required to report data breaches to the cybersecurity authority within a reasonable period. This closes a critical gap: under current law, there is no universal, mandatory breach notification requirement. Companies can discover a breach, contain it quietly, and never inform the public or regulators — a practice that has allowed cyber threats to fester undetected across the Philippine digital ecosystem.
The Second-Order Effect on Filipino Professionals
Legislation that creates a new regulatory agency rarely stays inside the Beltway. The cybersecurity bill Philippines is debating will ripple outward into every sector it designates as critical infrastructure — and for Filipino professionals, that means banking, telecom, healthcare, energy, and transportation.
For IT and cybersecurity professionals, the NCSA’s creation signals a formalization of the career path. The Philippines already faces a cybersecurity workforce shortage that the National Cybersecurity Plan 2023-2028 explicitly tries to address through capacity-building and training programs. A statutory agency with enforcement authority will accelerate demand for certified security professionals — and for the training infrastructure that produces them. The 2026 national budget already includes funding for cybersecurity through the DICT, CICC, and NPC. A law would lock that funding into permanent mandate rather than annual appropriation.
For business owners and entrepreneurs, the mandatory breach reporting requirement is the provision to watch. If your company operates in any of the eight CII sectors, HB 9605 would obligate you to report breaches — not as a best practice, but as a legal duty. That means incident response plans, logging systems, and breach notification protocols become compliance requirements, not optional security measures. The global average cost of a data breach in 2026 is $4.88 million, according to SentinelOne, a figure that underscores why incident response planning is no longer optional. Filipino companies that delay breach detection and reporting face not only that cost but potential legal liability under the new framework.
For OFWs and diaspora professionals, the connection is more indirect but no less real. Remittance corridors, online banking, and digital identity systems all run through infrastructure that HB 9605 would protect. The 19.2 million compromised credentials in H1 2026 represent real people — many of them overseas Filipino workers whose bank accounts, e-wallets, and digital identities are stored in Philippine systems. A cybersecurity law that mandates breach reporting means faster notification when those systems are compromised, giving OFWs time to protect their accounts before damage spreads.
What Comes Next
HB 9605 has passed second reading in the House. The legislative path forward requires a third reading vote in the House, then transmission to the Senate, where a counterpart bill would need to go through committee hearings and plenary votes. If the two chambers pass different versions, a bicameral conference committee reconciles them before the enrolled bill goes to the President for signature.
The political momentum is real. Speaker Faustino “Bojie” Dy III has signaled that cybersecurity is among the administration’s priority measures. The LEDAC’s Common Legislative Agenda for the 20th Congress, updated as of August 6, 2026, includes amendments to the Anti-OSAEC Act and child online safety provisions — both of which intersect with cybersecurity infrastructure. And the bill’s sponsors, Villafuerte and Poe, have framed it as national security, not IT policy — a framing that tends to accelerate legislative timelines.
But there is a deeper question worth watching. The cybersecurity bill Philippines is debating creates an agency. It does not, by itself, create the workforce, the technical capacity, or the enforcement culture that agency needs to function. South Korea’s $25.6 million KOICA investment will help build the physical infrastructure. The National Cybersecurity Plan 2023-2028 provides the roadmap. But the gap between having a law on paper and having a functioning cybersecurity apparatus is the same gap that every emerging digital economy faces — and the Philippines is starting from further behind than most of its ASEAN neighbors.
The World Economic Forum’s Global Cybersecurity Outlook 2026 found that 70 percent of large employers (100,000+ employees) have increased their focus on threat intelligence, compared to only 30 percent of small employers. In the Philippines, where the vast majority of businesses are SMEs, that disparity is starker. A law can mandate standards. It cannot, by itself, make small businesses capable of meeting them.
That is the real test for this cybersecurity bill Philippines is counting on. Not whether it passes — the political winds favor that. But whether the NCSA, once created, can build the capacity to enforce its mandates across an archipelago of 7,600 islands, millions of SMEs, and a digital infrastructure that has already been breached more times in 2026 than most countries experience in a decade.
Frequently Asked Questions About the Cybersecurity Bill Philippines
What is House Bill 9605?
House Bill 9605 is the National Cybersecurity and Critical Information Infrastructure Protection Act of 2026, filed in the 20th Congress. It creates the National Cybersecurity Agency (NCSA) as the central authority for cybersecurity policy and critical infrastructure protection. The bill passed second reading in the House of Representatives on August 4, 2026, sponsored by Reps. Miguel Luis Villafuerte and Brian Poe.
Does the Philippines currently have a cybersecurity law?
No. The Philippines does not have a dedicated cybersecurity law. The country relies on the Cybercrime Prevention Act of 2012 (RA 10175), DICT issuances, the National Cybersecurity Plan 2023-2028, and executive orders. The cybersecurity bill Philippines is now debating would be the first comprehensive cybersecurity legislation with the force of statute.
What sectors does HB 9605 cover?
The bill designates Critical Information Infrastructure across eight sectors: banking and finance, broadcast media, emergency services and disaster response, energy, health, telecommunications, transportation (land, sea, air), and water. Both public and private entities operating in these sectors would fall under the NCSA’s standards.
How bad is the cyber threat in the Philippines?
In the first half of 2026, the Philippines recorded 16,619 phishing attacks, 255 data breaches, 21 ransomware incidents, and 19.2 million compromised credentials, according to Viettel Cyber Security. In 2025, 266 data breach incidents exposed approximately 228 million credentials. BlueVoyant reported that 100 percent of Philippine organizations experienced supply chain cybersecurity incidents.
What would the mandatory breach reporting requirement mean for businesses?
If HB 9605 passes, companies operating in critical infrastructure sectors would be legally required to report data breaches to the NCSA within a reasonable period. This means businesses need incident response plans, breach detection systems, and notification protocols in place — not as best practices, but as legal compliance measures.
When would HB 9605 take effect?
The bill must pass third reading in the House, then go through the Senate (committee hearings, plenary votes), and potentially a bicameral conference committee. If enacted, it would be signed by the President and take effect 15 days after publication in the Official Gazette. The exact timeline depends on Senate action, which has not yet scheduled hearings on a counterpart bill.
How does this affect OFWs and overseas Filipino professionals?
OFWs rely on Philippine digital infrastructure for remittances, online banking, e-wallets, and government services. The 19.2 million credentials compromised in H1 2026 include accounts belonging to overseas Filipinos. A cybersecurity law with mandatory breach reporting would provide faster notification when systems are compromised, giving OFWs time to protect their financial accounts and digital identities.
Disclaimer: This article is for informational purposes only and does not constitute legal, cybersecurity, or financial advice. Readers should consult qualified professionals for guidance specific to their circumstances. References to legislation reflect the status of bills as of the publication date and may change as Congress continues deliberations.
