The Philippines division of Taiwanese tech firm Acer has confirmed that information related to its employees has been leaked after a third-party vendor suffered a security breach.

An attacker called “ph1ns” posted a link on a hacking forum to a stolen database containing employee attendance data from Acer Philippines. The database reportedly included workers’ names, usernames, passwords, roles, departments, employer’s name, birthdates, mobile numbers, and email addresses.

Ph1ns said they were not selling the data, but offering it for free to anyone interested.

Is the free access to the stolen data an indication that the attacker does not think that the stolen information is easy to monetise or an altruistic act by Ph1ns?

Your guess is as good as mine. But the hack of the unnamed third-party vendor was claimed to have occurred under the banner of “#OpEDSA” – a movement calling for political change in the Philippines, which has targeted companies in the country.

It’s worth underlining that the stolen data was not taken directly from Acer, and there has been no evidence of a breach in the company’s systems.

Instead, it appears that the company managing Acer Philippines employee attendance data suffered its own security breach.  Of course, that is little comfort for workers who will be understandably unhappy that their personal details have fallen into the hands of hackers and are being shared via hacking forums.

In a statement posted on Twitter, Acer Philippines also emphasised that no customer data was exposed due to the leak.

That’s certainly a silver lining for Acer laptop buyers. And a better situation than almost ten years ago when Acer’s ecommerce website was hacked allowing hackers to steal customers’ details, including (gulp!) payment card information.

Acer can once more argue that it wasn’t its infrastructure that was hacked, but it has suffered security breaches in the past – including a $50 million ransomware attack, the theft of 60GB worth of files from its Indian servers.

All businesses need to secure their systems and have confidence that the data entrusted to third parties will be kept safely out of the reach of hackers.