Written November 3, 2026, from public statements by St. Luke’s Medical Center and the National Privacy Commission. We’ll update it as more comes out.
If you watched the news this week, you probably saw this one. Here’s what has actually been said, and what a small business can take from it.
What’s been said so far
St. Luke’s says it spotted a cybersecurity incident on October 29, affecting part of the platform behind its mobile app. An outside provider manages that platform. The hospital says some personal information of patients and employees may be involved. It took the app offline, isolated the platform, and says its medical records system and core clinical systems weren’t touched. The National Privacy Commission says the hospital notified it on October 30 and that it’s now reviewing the report. St. Luke's Medical Center probing cybersecurity incident on mobile app +3
What nobody has said yet
The hospital hasn’t said exactly what data was taken. Neither it nor the NPC has said how many people are affected. And there are no investigation results or return date for the app yet. Manila Bulletin - St. Luke's hit with data breach, NPC confirms +2
We’re not going to guess who did it or how. Nobody outside the investigation knows, and speculation doesn’t help the people whose data may be involved. This also isn’t a dig at St. Luke’s. We want to use the story to talk about something that affects almost every business.
The part that applies to you
The platform behind that app was run by someone else. Think about your own setup. Your website host, your booking tool, your payment provider, your email service, the freelancer with admin access to your app. Your customers gave their details to you. If one of those vendors gets breached, your customers will still come to you.
The law works the same way. Under the Data Privacy Act, you must tell the NPC and the affected people within 72 hours of learning about a breach. That clock runs from when you find out. If your vendor sits on bad news for a week, you’ve lost most of your time before you even start.astig
What we’d want in place before anything goes wrong
A list of who holds your data. Every vendor, what they hold, and who on your team owns that relationship. You can’t protect what you can’t list.
Security written into the contract. Ask for breach notice within a day or two, not “as soon as practicable”. Also ask what happens to your data when the contract ends.
Less data shared. Give vendors only what they need, and delete what you no longer need.
MFA on every admin account, including your vendors’ accounts on your systems. No shared logins. Remove access the day someone leaves.
Secrets kept out of the app. Passwords and API keys belong in a proper vault, never inside the code that ships to people’s phones.
Separation. If the app platform gets hit, it shouldn’t be a short walk to your core records.
Alerts that someone actually reads. Unusual downloads, thousands of record lookups, repeated failed logins.
A plan for the bad day. Who decides, who talks to the NPC, who tells customers, and how you switch something off quickly. Write the notice drafts before you need them.
Backups you’ve actually restored, at least once, to see that they work.
Checks worth doing
Before an app goes live:
Have someone test whether user A can ever open user B’s records. This one fails more often than you’d think.
Run a penetration test on the app and its API.
Scan the code and the app package for leftover passwords and keys.
Put limits on login attempts and record lookups.
On your vendors:
Ask for proof, such as an ISO 27001 certificate, a SOC 2 report, or a recent penetration test summary.
Get their MFA, logging, and encryption answers in writing.
Review who has access every quarter.
On a regular schedule:
Patch and update every month.
Clean out old accounts every quarter.
Twice a year, sit down and walk through “our vendor just told us they were breached.” Who calls whom? You’ll find the gaps in an hour, much cheaper than finding them live.
If you’re a patient or app user
St. Luke’s says anyone whose information may be involved will be contacted directly. It also urges people to be careful with any request for personal information. In practice: never share an OTP or password with anyone who calls or texts you, and check anything unexpected by contacting the hospital through its official channels. Use a different password for every account. tribuneinquirer
Want a second pair of eyes?
At Northgate IT Consultancy we help Philippine startups and small businesses review vendor risk, app security, and Data Privacy Act readiness. If this made you wonder about your own setup, send us a message at northgate-it.com.ph/contact. A short conversation is free.