Incident BriefingsSt. Luke’s Medical Center Philippines mobile-platform incident

St. Luke’s Medical Center Philippines mobile-platform incident

St. Luke’s Medical Center in the Philippines identified unauthorized access to a third-party platform supporting its mobile application.

Last modified

Summary

  • Environment: Third-party platform supporting a hospital mobile application
  • Operational impact: Patient and employee information potentially affected; care unaffected
  • Financial impact: No incident cost disclosed
  • Record status: Developing record. Reviewed November 3, 2026; updated as evidence emerges.

What happened

St. Luke’s Medical Center in the Philippines identified unauthorized access to a third-party platform supporting its mobile application. [1]

Impact

Personal information belonging to some patients and employees was potentially affected. The notice did not confirm theft or specify categories and counts. [1]

The hospital said operations remained unaffected. [1]

Timeline

  1. Hospital publishes notice

    Hospital publishes notice, as described in the company notice.

    [1]

  2. Briefing updated

    This briefing was last reviewed and updated on November 3, 2026.

Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

Actors

  • No threat actor group has been identified in the reviewed public evidence.

TTPs

  • No specific MITRE ATT&CK technique is currently mapped for this case.

Response

St. Luke’s implemented containment measures, engaged independent cybersecurity experts and said potentially affected individuals would be notified directly. [1]