Hacker-linked accounts taken down for SONA 2026 disruption attempts

The Cybercrime Investigation and Coordinating Center (CICC) has flagged nine social media accounts linked to alleged hackers who supposedly attempted to disrupt President Ferdinand Marcos Jr.'s fifth State of the Nation Address (SONA). Speaking on the Bagong Pilipinas Ngayon program on Wednesday, CICC Undersecretary Renato Paraiso said several social media accounts linked to hacker groups were taken down. "May na-flag tayo na siyam na individuals and groups na kaugnay ho, 'yung iba kaugnay ng mga hackers… na layuning manggulo sana at manghikayat sa ating mga kababayan na magkaroon ng dissent o magkaroon ng pagtitipon para manggulo sa SONA," Paraiso said. (We flagged nine individuals or groups that are, well some are linked to hackers… who had the goal of disrupting or encouraging our citizens to dissent or gather to disturb the SONA.) Paraiso said their data have been preserved and turned over to law enforcement agencies. An indicator that these threats were credible was whether or not the individual or group had the capacity to carry out these threats. "Sometimes, what they do is flood us with threats so that we don't find them. It also spreads our resources thin," Paraiso said in Filipino. The CICC official said the individuals and groups behind these accounts face charges of computer fraud and identity theft. They may also be charged with grave threats, inciting to sedition or rebellion, and more. Paraiso said that while they respected everyone's freedom of speech, punishment must be rendered when those statements begin to break the law. In the hours leading up to Marcos' SONA, two suspected improvised explosive devices (IEDs) were discovered, with one of them actually going off. An explosion was reported Monday in the Department of Justice's compound in Manila City, and hours later, a suspected IED was discovered near the Senate in Pasay City. Police suspect that the two incidents are related. — VDV, GMA News