NEWS
Strengthening ICT supply chain resilience is everyone’s business
December 13, 2021 2:22 p.m.
By Genie Sugene Gan, Head of Government Affairs, Asia-Pacific, Kaspersky
NotPetya, WannaCry, ShadowPad, and Sunburst may or may not be household names, but these malware, and many more, have unleashed significant harm on the world.
Recently, one such instance of malware was used to attack an IT services company based in Dublin, which supplies security software to scores of large cybersecurity contractors. Working through the company, hackers infected hundreds of its clients worldwide with ransomware, and demanded USD 50,000–5 million from each business in exchange for the decryption key.
Earlier this year, another attack hit an American IT software company, and subsequently infiltrated nine U.S. federal agencies, including the Office of the President, and the Treasury and Commerce Departments.
What these attacks have in common is their modus operandi: hackers targeted software vendors or IT companies to gain backdoor access to their clients’ systems, infecting hundreds and thousands of systems in one go.
This is perhaps how “supply chain” got its name – each part of the process stream is inevitably linked to another. When one part gets affected, a domino effect soon follows.
The Problem
ICT supply chain cyberattacks are on the rise – the European Union for Cybersecurity estimates a four-fold growth in attacks in 2021 compared to 2020. The risk is compounded as vulnerabilities can be introduced at any phase of the ICT life cycle: from design – through development, production, distribution, acquisition and deployment – to maintenance.
The impact of these breaches is also set to grow, given the increasing interconnection of IT systems across organizations, sectors and countries. In a 2019 survey by Gartner, 60% of organizations reported working with more than 1000 third parties.
Upon successful infiltration, cybercriminals enjoy free rein to conduct cyber espionage, steal data and intellectual property, or extort money through ransomware attacks, which have been on the rise. From 2019 to 2020, the number of Kaspersky users encountering targeted ransomware – malware used to extort money from high-profile targets such as corporations, government agencies, and municipal organizations – increased by 767%.
While the impact on governments and enterprises may feature more prominently, the wider public is not spared. An attack on a grocery chain could force the temporary closure of scores of supermarkets, or a virus may be unleashed on millions of PC users through a software update (as, for example, occurred in the ShadowHammer3+1 attack, which Kaspersky detected and promptly mitigated in 2019). Taking it further, the compromise of systems providing healthcare or public utilities may disrupt the provision of these essential services. And these are the very day-to-day things that affect individuals like you and me.
Early Responses
Recognizing the risks and impact of supply chain cyberattacks, more countries are taking action. Since 2020, national cybersecurity strategies were either released or updated across Asia-Pacific, including in Singapore, Malaysia, Australia and Japan. Other countries, like Vietnam, India and Indonesia, are soon expected to release their own national strategies or implementation details too.
But when it comes to ICT supply chain resilience, the solution is more complex in view of the multitude and range of stakeholders involved. Some governments have intervened, with a focus on protecting the ICT supply chains of Critical Information Infrastructure (CII):
- In 2018, the U.S. Department of Homeland Security established the ICT Supply Chain Risk Management Task Force, a public-private partnership to develop consensus on risk management strategies to enhance global ICT supply chain security. The Task Force has released guidelines on the sharing of supply chain risk information, and risk considerations for managed service provider customers.
- The Australian Cyber Security Centre also published guides this year for businesses to identify cybersecurity risks associated with supply chains, and to manage these risks.
- The Cybersecurity Agency of Singapore announced that it will shortly launch a CII Supply Chain Programme for stakeholders to adhere to international best practices and standards for supply chain risk management.
The Way Ahead
The global nature of ICT supply chains necessitates a stronger, coordinated response at every level.
Globally, countries and International Organizations (e.g., INTERPOL, the UN, ASEAN, Europol) have taken steps to tighten cooperation and share best practices:
- Multilateral platforms – Today, the United Nations Group of Governmental Experts and Open-ended Working Group are platforms that can be used by countries to develop consensus around cyber processes and norms. Conferences such as the UN Internet Governance Forum provide further opportunities to discuss at the working level: in 2020, Kaspersky together with our partners organized a workshop to discuss the need and ways to develop assurance and transparency in global ICT supply chains.
- Bilateral partnerships – Countries around the region, including Vietnam, India, Japan, Singapore, China and South Korea, have committed to MOUs on various aspects of cybersecurity – an important step in making progress domestically and globally.
While each of these platforms plays an important role in building consensus, exchanging knowledge and best practices, and harmonizing standards, moving forward, it is imperative to have more targeted conversations on global ICT supply chain resilience, given the wide-ranging types of actors and impact involved globally.
Nationally, governments must continue to drive nationwide efforts to establish a baseline level of cybersecurity across sectors through laws, regulations, guidelines, training requirements and awareness building. The examples above provide a sense of some of the measures undertaken by governments.
Given the integrated nature of ICT supply chain resilience, there is a particular need to develop core principles (e.g., security-by-design), technical standards and legislative/regulatory frameworks to ensure a consistent level of cybersecurity and accountability across stakeholders. Self-assessment tools can also be published in addition to facilitate implementation.
Individually, everyone is responsible for ensuring our collective cybersecurity. Naturally, businesses that develop products and maintain systems must lead the way.
At Kaspersky, we believe that transparency in the components within and connections across software supply chains is the best way to ensure the integrity and trustworthiness of our digital infrastructure. Our commitment to this principle is evidenced by our Global Transparency Initiative, where, among other things, we:
- Welcome third parties to review our source code. More recently, we made it easier for our partners and the public to understand what is inside our products by providing a software bill of materials – a list of all the components, information about them, and the relationships between them.
- Practice responsible vulnerability disclosure, and have on many occasions, alerted IT companies regarding vulnerabilities in their systems, averting several potentially significant cyberattacks.
Cybersecurity is everyone’s business because our collective cybersecurity is only as strong as that of the weakest link among us. To remain ahead of the game, a holistic approach involving all stakeholders is required. We must look beyond playing catch-up and reacting to cyberthreats. It is imperative to take a long-term approach in designing the cybersecurity ecosystem, which includes building a strong talent pipeline to meet the needs of CERTs, forensic analysis teams, and IT departments, and designing CII that is secure-by-design.
The ideas above are by no means an exhaustive list, but hopefully, they provide an idea of where to begin – together – in view of the long way that lies ahead of us.
NEWS
COA files 4 fraud audit reports worth over ₱275 million for Bulacan flood control projects
9:19 p.m. February 13, 2026
THE Commission on Audit (COA) has filed four Fraud Audit Reports (FARs) before the Office of the Ombudsman involving more than ₱275 million worth of flood control projects in Bulacan, citing alleged ghost projects, unauthorized site relocations, payments for pre-existing structures, and serious documentation deficiencies.
The projects were implemented by the Department of Public Works and Highways (DPWH)–Bulacan 1st District Engineering Office and awarded to SYMS Construction Trading and Wawao Builders.
COA said the filing of the cases underscores its commitment to transparency and accountability to ensure that public funds intended for flood mitigation are properly used.
Based on physical inspections, geotagged photographs, and historical satellite imagery, state auditors reported recurring irregularities:
Ghost projects: No flood control or riverbank protection structures were found at approved project sites, despite reports that the projects were completed or substantially accomplished.
Unauthorized relocation of sites: In several instances, DPWH representatives allegedly led inspectors to locations different from those specified in approved plans and contracts, without revised plans or written authority.
Payments for pre-existing structures: Satellite imagery showed that some riverbank protection structures already existed prior to contract effectivity, raising the possibility that payments were made for works not newly constructed.
Documentation deficiencies: Required documents, including as-built plans, detailed cost breakdowns, Statements of Work Accomplished, and approved master plans, were either incomplete or missing, undermining the credibility of reported accomplishments and payments.
Audit Coverage
The fraud audit stemmed from a directive issued on Aug. 12, 2025 by COA Chairperson Gamaliel A. Cordoba ordering an immediate review of DPWH flood control projects in Bulacan covering July 1, 2022 to May 30, 2025, following public concerns over alleged ghost projects and corruption.
Disputed Projects
Hagonoy, Bulacan (SYMS Construction Trading)
The ₱67.55-million project involved the construction of a reinforced concrete flood control structure at Barangay Santa Monica (Purok 6 to Purok 7). COA reported that no such structure was found at the designated site despite the project being declared 100 percent complete as of June 11, 2024 and fully paid by June 19, 2024. Auditors also noted indications of unauthorized site changes and missing required documents.
Pandi, Bulacan (SYMS Construction Trading)
The ₱39.60-million riverbank protection project at Barangay Malibong Bata was allegedly built at a location different from that specified in approved engineering plans, without documented authority for relocation. Structures found at both the approved and identified sites could not be conclusively linked to the contract. Several key documents were also missing.
Baliuag, Bulacan (Wawao Builders)
The ₱72.37-million Phase IV riverbank protection project at Barangay San Roque was reportedly constructed at a site different from that indicated in the approved bid plans. The structure bore markings corresponding to another project. Geotagged progress photos used to support payments were taken before the issuance of the Notice to Proceed and pointed to a different barangay. COA also cited overlapping project locations with another flood control contract and incomplete documentation.
Plaridel, Bulacan (Wawao Builders)
The ₱96.50-million flood control structure along the Angat River in the Lumang Bayan section was found to have existing structures at the site at least 90 days before contract effectivity, based on satellite imagery and inspection. The structures bore markings of different contract IDs and differed in design from approved plans. Despite this, the project was reported 100 percent complete within 65 days from contract effectivity. Auditors again noted missing supporting documents.
Possible Violations
COA said those involved may face charges for violations of Republic Act No. 3019, or the Anti-Graft and Corrupt Practices Act, as well as malversation and falsification of documents under the Revised Penal Code. Possible violations of COA Circular No. 2009-001 were also cited.
The audit body said additional reports may be filed with the Ombudsman as investigations continue, in line with President Ferdinand Marcos Jr.’s call for transparency and accountability in government spending.
NEWS
ILO study says TNVS drivers earn way above minimum wage
8:49 p.m. February 11, 2026
Transport network vehicle services (TNVS) riders and drivers receive above the mandated minimum wage in the Philippines, according to a recent study commissioned by the International Labor Organization (ILO).
In the “2025 Platform Work Survey: Philippines” presented during the Department of Labor and Employment’s (DOLE) 2026 National Tripartite Conference, it also noted that digital platforms are a major source of livelihood in the country because of the flexible working arrangements they offer.
According to the survey that covered 12 out of 17 regions in the country, the average net earnings of a TNVS rider or driver per week reach P6,704.00, net of costs, as opposed to the average minimum wage of approximately P498 to P695 per day or P4865 weekly set by the government.
The survey was conducted from June to December 2025 and interviewed 400 respondents from nine platforms providing food delivery, logistics and parcel delivery, and ride-hailing services. It has a margin of error of 5 percent.
The ILO commissioned a comprehensive survey on platform work, including delivery and TNVS riders and drivers, to analyze the working conditions of workers in the platform economy, document labor practices, assess the impact of digital platforms on employment, and inform enterprise formalization and social protection strategies.
Based on the ILO study, nearly 90 percent of the riders and drivers indicated that they have access to social protection provided by the platform, including health insurance, insurance for workplace injury, and pension plan or retirement benefit.
Among the top reasons the TNVS riders considered for choosing this industry are flexibility, which allows them to select their schedules and attend to family and personal matters, and decent earnings, which they deemed better than other available jobs.
According to riders and drivers, there are platform initiatives to improve their working conditions, such as increasing earnings and incentives, enhancing training and safety, and improving operational support and communication channels.
The study also noted that ride-hailing app platforms are specifically focusing on facilitating mandatory government benefits—Social Security System (SSS), PhilHealth and Pag-IBIG—to their drivers.
NEWS
DigiPlus deepens investments in Customer Care across BingoPlus, ArenaPlus, and GameZone
6:12 p.m. February 10, 2026
DigiPlus Interactive Corp. (DigiPlus), the pioneer and leading digital entertainment provider behind BingoPlus, ArenaPlus, and GameZone, continues to strengthen its investments and capabilities in customer care, reinforcing its commitment to providing reliable, player-first support across its platforms.
The company reports that its 24/7 customer service operations are now backed by a 450-strong workforce, reflecting sustained investment in high-caliber talent, intensive training, and rigorous service standards. These investments underpin DigiPlus’ efforts to build a scalable customer support organization that champions service quality and upholds Responsible Gaming for players.
“As a leader in digital entertainment, we recognize our responsibility to build and sustain a customer-first service culture,” said Carlos Feliciano, Customer Service Director at DigiPlus. “By designing a scalable, future-ready framework and streamlining processes for simplicity and speed, we aim to make support effortless and intuitive—and elevate the overall customer experience for BingoPlus, ArenaPlus, and GameZone players.”
A more robust training framework to build a high-caliber, human-centered team
Great service starts with a strong training foundation. In 2025 alone, the DigiPlus customer service team collectively logged over 87,000 training hours. DigiPlus has since expanded its customer care training programs to ensure teams are equipped to thrive in fast-paced and complex business operations. Recognizing the need for more immersive learning beyond traditional classroom instruction, the company enhanced its training framework to better prepare customer service teams for real-world scenarios.
The updated approach blends foundational learning with guided, hands-on experience, allowing frontliners to apply skills early while receiving structured coaching from senior team members over an extended, progressive training period. This ensures that BingoPlus, ArenaPlus, and GameZone customer-facing teams are confident, capable, and ready to deliver consistent, high-quality service.
Alongside capability-building, DigiPlus emphasizes human-centered service. Customer care teams are trained to prioritize meaningful conversations over scripted responses, respect players’ time, and resolve concerns more effectively by viewing each interaction as part of a broader customer journey.
Readiness to provide Responsible Gaming support for players
Responsible Gaming remains a key pillar of DigiPlus’ customer care strategy. Customer service teams also undergo a dedicated Responsible Gaming training module that equips them to recognize potential indicators of gaming-related concerns among customers and respond with professionalism, empathy, and appropriate support.
As part of this approach, customer care teams are trained to guide players through available Responsible Gaming tools and safeguards on the platforms, such as options to manage gaming duration or schedule, set limits on deposits or spending, or request self-exclusion or temporary account deactivation. These Responsible Gaming tools are designed and pioneered by DigiPlus to help protect players and encourage more mindful and balanced gameplay.
Where customers require additional well-being support, customer frontliners may also direct players to further resources, including the EmbracePLUS mental health helplines (Smart: 0908-235-2351, Globe: 0956-392-1924; open daily from 12:00 PM to 8:00 PM), which provide Psychological First Aid, and other independent support organizations.
Scaling customer engagement efficiencies in 2026
Looking ahead to 2026, DigiPlus aims to further strengthen customer service operations by driving greater efficiency through innovation. The company plans to continue enhancing processes and responsibly leveraging technology to streamline workflows, improve response times, and enable smarter, more personalized customer support—laying the groundwork for a scalable and future-ready service experience.
COA files 4 fraud audit reports worth over ₱275 million for Bulacan flood control projects
inDrive is 4th most downloaded travel app in PH
ILO study says TNVS drivers earn way above minimum wage
