Philippine Savings Bank (Metrobank Group) Listed by qilin Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Philippine Savings Bank, part of the Metrobank Group, was listed on a ransomware leak site on 28 January 2026. The number of people whose data may be involved remains unknown, and the precise contents of any material taken have not been made public. For customers and staff, the immediate questions are what records were removed and how those records could be used.

Breaking down the breach

The only confirmed public information is that the bank appeared on the Qilin ransomware group’s leak site. The group claims to have stolen internal data during a ransomware attack. No figure for the volume of data, the number of affected individuals, or the date of the intrusion has been released. It is not known whether the data was encrypted, whether ransom demands were issued, or whether any material has been published beyond the initial listing.

Inside qilin

Qilin is a ransomware operation that typically gains access through compromised remote services or stolen credentials, deploys encryption across targeted systems, and then lists victims on its leak site when payment is not received. The group’s listings serve as a public claim that files have been taken; independent verification of those claims is often limited until material appears or the victim confirms the incident.

Who is Philippine Savings Bank?

Philippine Savings Bank is a retail bank operating in the Philippines and affiliated with the Metrobank Group. Institutions of this type maintain customer account records, loan documentation, identification details, and internal operational files. A breach at a bank raises questions about the security of financial and personal information that customers entrust to the institution for everyday banking and lending services.

The information in question

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of specific data types has been published. Banks routinely hold account numbers, transaction histories, customer names and addresses, government identification, and internal communications; whether any of these categories are present in the material claimed by the group is unconfirmed.

Why it matters

Internal bank files can contain details that support identity verification or financial transactions. If such records become available, they may be used for targeted fraud or account takeover attempts. For the bank, the incident adds to regulatory and operational costs associated with investigating the access and notifying affected parties where required.

Were you affected?

Public detail on individual exposure is limited. People can take the following steps while waiting for official statements:

• Review recent account statements for unfamiliar transactions.
• Enable transaction alerts and multi-factor authentication on banking apps.
• Contact the bank directly using verified contact details listed on its official website.
• Run a free exposure scan of their email address against known breach data sets to check for prior appearances of their information.

AICompiled with AI assistance from public sources and published under our editorial standards.