---
title: Philippines' St. Luke's Medical Center says attackers got into the third-party platform behind its eHealth Hub app; the privacy regulator says about 100,000 people are affected | ctxsec
url: https://ctxsec.com/items/st-lukes-medical-center-ehealth-hub-app-breach-100k-npc
description: "St. Luke's, which runs hospitals in Quezon City and Taguig, says it found unauthorized access on Oct 29 to part of the platform supporting its mobile app, which a third-party provider manages. It isolated the platform, took the app offline, hired outside forensic experts and notified the National Privacy Commission on Oct 30. It says its electronic medical records and core clinical systems were not affected and it is notifying affected patients and employees directly. Deputy Privacy Commissioner Jose Belarmino II told GMA News about 100,000 people were affected, the largest of 18 hospital breaches reported to the NPC, and that it is examining whether the hospital is liable. One notified patient said his name, email, birthday, patient number and dependents may have been exposed."
status: "official (St. Luke's Medical Center notices, Oct 30 and Nov 2; National Privacy Commission comments to GMA News). The ~100,000 figure is from the NPC"
published: 2026-11-04
---

> St. Luke's, which runs hospitals in Quezon City and Taguig, says it found unauthorized access on Oct 29 to part of the platform supporting its mobile app, which a third-party provider manages. It isolated the platform, took the app offline, hired outside forensic experts and notified the National Privacy Commission on Oct 30. It says its electronic medical records and core clinical systems were not affected and it is notifying affected patients and employees directly. Deputy Privacy Commissioner Jose Belarmino II told GMA News about 100,000 people were affected, the largest of 18 hospital breaches reported to the NPC, and that it is examining whether the hospital is liable. One notified patient said his name, email, birthday, patient number and dependents may have been exposed.

[← Cybersecurity News](/news) · [markdown](/items/st-lukes-medical-center-ehealth-hub-app-breach-100k-npc.md)

official (St. Luke's Medical Center notices, Oct 30 and Nov 2; National Privacy Commission comments to GMA News). The ~100,000 figure is from the NPC

2026-11-04

### Philippines' St. Luke's Medical Center says attackers got into the third-party platform behind its eHealth Hub app; the privacy regulator says about 100,000 people are affected

**For patients:** expect phishing that references St. Luke's or lab results; the hospital is contacting people directly, so verify any notice through its official site. If you reused your app password, change it elsewhere.

**For hospitals:** patient apps run by vendors sit outside most EMR controls; check what data the vendor platform holds and how fast you can cut it off.

Sources: [St. Luke's: Notice on a Data Security Incident (Oct 30)](https://www.stlukes.com.ph/news-and-events/news-and-press-release/notice-on-data-security-incident) · [GMA News: St. Luke's probing data security incident; NPC on ~100,000 affected](https://www.gmanetwork.com/news/topstories/nation/1008108/st-luke-s-medical-center-probing-cybersecurity-incident-on-mobile-app/story/) · [Rappler: St. Luke's, NPC investigating data breach on mobile app](https://www.rappler.com/technology/st-lukes-investigating-data-breach-mobile-application/)