MANILA (UPDATED) — The data breach at Jollibee Group has affected 11 million data subjects across the congolomerate's brands, the National Privacy Commission said in a release Monday.

The breach has affected sensitive personal information, including customers' dates of birth and Senior Citizen ID numbers, the commission, which Jollibee notified of the breach on Saturday, said.

The NPC said the breach involved "unauthorized access to [Jollibee Group's] data lake, which holds data for all companies in the group." 

Most of the data subjects affected by the breach were Jollibee customers but customers of Mang Inasal, Red Ribbon, Chowking, Greenwich, Burger King and Yoshinoya, and Panda Express were also affected.

READ: Jollibee Group investigates data breach

"Jollibee Foods Corporation has requested an additional 20 days to complete its internal investigation," the commission also said.

According to the Department of Information and Communications Technology (DICT), the Jollibee Corporation has formally asked for assistance following the data breach.

"Kasi kanina lang, nag-usap na ho kami ng isa sa mga corporate heads ho ng Jollibee. Kasi nangyari ho ito Friday, nagkaroon tayo ng report, finallow-up ng DICT," said DICT Spokesperson Assistant Secretary Renato "Aboy" Paraiso. "Nakita naman ho natin sa dark web na talagang may mga data from Jollibee na nandoon na sa dark web."

This is not the first time that a Philippine company or agency has been subjected to hacking. Last week, Philippine authorities apprehended a number of individuals suspected to be behind a number of cybersecurity attacks against a number of government agencies and private entities. 

Paraiso said they support the filing of charges against the individuals even as they claim to be "hacktivists" or someone who attacks computer systems to remind corporations to beef up their cybersecurity systems.

"Ang problema sa mga 'hacktivist' na ito, if they are unsanctioned, parang ang lumalabas, 'We're doing this so you can up your game para ho ma-improve ninyo iyong mga sistema ng government, ma-improve ninyo iyong cybersecurity capability ninyo'," he said. "Pero ang nangyayari, dina-dump nila iyong information doon naman sa dark web, as a proof of life, as a proof of concept na na-hack talaga nila ito."

"Ang problema, iyong mga data na dina-dump nila are sensitive personal data minsan ng mga kababayan ho natin, which in itself, a violation of data privacy act. So iyon ho ang difference ho siguro ng mga sanctioned at unsanctioned na ano, puwede naman hong i-test iyan in a safe environment," he added.

READ: IT officer arrested for allegedly hacking gov’t, bank websites

Data breaches, especially of sensitive personal information increase the risk of identity theft and of falling victim to scams.

Health maintenance organization (HMO) Maxicare last week also reported a data breach through a third-party homeware provider. 

The breach affected around 13,000 Maxicare members. -- with Pia Gutierrez, ABS-CBN News

RELATED VIDEO