---
title: "St. Luke’s Medical Center Philippines mobile-platform incident"
description: "St. Luke’s Medical Center in the Philippines disclosed unauthorized access to a third-party mobile-app platform, with possible personal-data exposure."
incident_type: "Cybersecurity incident"
status: "active"
last_modified: "2026-11-03"
canonical_url: "https://www.ally.security/incidents/st-lukes-philippines-mobile-platform-incident-2026"
markdown_url: "https://www.ally.security/incidents/st-lukes-philippines-mobile-platform-incident-2026.md"
stix_url: "https://www.ally.security/incidents/st-lukes-philippines-mobile-platform-incident-2026/stix.json"
---

# St. Luke’s Medical Center Philippines mobile-platform incident

St. Luke’s Medical Center in the Philippines identified unauthorized access to a third-party platform supporting its mobile application.

Last modified Nov 3, 2026 · 1 source

## Summary

- **Environment:** Third-party platform supporting a hospital mobile application
- **Operational impact:** Patient and employee information potentially affected; care unaffected
- **Financial impact:** No incident cost disclosed

## What happened

[St. Luke’s Medical Center](https://www.stlukes.com.ph/) in the Philippines identified unauthorized access to a third-party platform supporting its mobile application. [1](#source-1)

## Impact

Personal information belonging to some patients and employees was potentially affected. The notice did not confirm theft or specify categories and counts. [1](#source-1)

The hospital said operations remained unaffected. [1](#source-1)

## Timeline

### October 30, 2026 — Hospital publishes notice

Hospital publishes notice, as described in the [company notice](https://www.stlukes.com.ph/assets/images/Notice_Data_Security.jpg). [1](#source-1)

### November 3, 2026 — Briefing updated

This briefing was last reviewed and updated on November 3, 2026.

## Threat Group & Attack Vector

The reviewed notice does not establish the initial access method.

### Actors

- No threat actor group has been identified in the reviewed public evidence.

### TTPs

- No specific MITRE ATT\&CK technique is currently mapped for this case.

## Response

St. Luke’s implemented containment measures, engaged independent cybersecurity experts and said potentially affected individuals would be notified directly. [1](#source-1)

## Assets

[Download the case-scoped STIX 2.1 bundle](<https://www.ally.security/incidents/st-lukes-philippines-mobile-platform-incident-2026/stix.json>)

## Sources

Primary source records used to research this incident.

<a id="source-1"></a>

### Notice on a Data Security Incident

official · St. Luke’s Medical Center Philippines · Oct 30, 2026

<https://www.stlukes.com.ph/assets/images/Notice_Data_Security.jpg>

<details>
<summary>Evidence ledger</summary>

Review the supporting structured claims.

1. **Resulted In · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: Hospital publishes notice
2. **Resulted In · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: Personal information belonging to some patients and employees was potentially affected. The notice did not confirm theft or specify categories and counts.
3. **Disclosed At · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: 2026-10-30
4. **Affected Organization · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: St. Luke’s Medical Center Philippines
5. **Resulted In · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: St. Luke’s Medical Center in the Philippines identified unauthorized access to a third-party platform supporting its mobile application.
6. **Resulted In · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: St. Luke’s implemented containment measures, engaged independent cybersecurity experts and said potentially affected individuals would be notified directly.
7. **Occurred At · 100% confidence · current**  
   Hospital publishes notice: 2026-10-30
8. **Resulted In · 100% confidence · current**  
   St. Luke’s Medical Center Philippines mobile-platform incident: The hospital said operations remained unaffected.

</details>