The National Privacy Commission (NPC) has launched an investigation into an alleged data breach involving G-Xchange, Inc., the operator of popular mobile wallet app GCash, following reports that user information was being sold on the dark web.

According to the NPC’s statement on Monday, October 27, a dark web post made on October 26, 2025, by the alias “Oversleep8351” allegedly offered to sell merchant and user data.

The information reportedly included GCash account numbers, linked bank and virtual card accounts, and Know Your Customer (KYC) records containing names, addresses, employment details, and valid Philippine IDs.

In response, the NPC’s Complaints and Investigation Division has issued a Notice to Explain (NTE) to G-Xchange, Inc. to obtain further details about the alleged incident.

The Commission has also scheduled an online clarificatory conference for a more in-depth discussion.

"Should the investigation confirm that the personal data of GCash users have been compromised, the NPC will take regulatory and enforcement action within its mandate under the Data Privacy Act of 2012," NPC said.

Meanwhile, the agency reminded GCash users to remain vigilant, regularly monitor their accounts, update their MPINs and passwords, and enable additional security measures. It also urged users to be cautious of phishing attempts and to avoid sharing personal or sensitive information while the investigation is ongoing.

Meanwhile, in a Facebook post, GCash asserted that there is no such evidence of any breach in its system.

"Your funds and information are safe and secure," said in a statement.

“Upon swift investigation by our cybersecurity experts, the alleged dataset does not match data from GCash systems. Additionally, many entries are incomplete, invalid, or do not belong to GCash users,” the company added.

The company also emphasized that it continues to coordinate closely with the government agencies to monitor and verify information from all possible sources to ensure that its systems remain protected.