{"id":5420,"date":"2026-10-18T02:46:55","date_gmt":"2026-10-18T02:46:55","guid":{"rendered":"https:\/\/cyberasia.io\/?p=5420"},"modified":"2026-10-18T02:46:57","modified_gmt":"2026-10-18T02:46:57","slug":"american-eye-manila-data-leak-2026","status":"publish","type":"post","link":"https:\/\/cyberasia.io\/article\/data-leak\/american-eye-manila-data-leak-2026\/","title":{"rendered":"American Eye Manila Data Leak 2026: Karawang Error System"},"content":{"rendered":"\n

The American Eye Manila data leak surfaced when a group calling itself Karawang Error System<\/mark><\/strong> posted a spreadsheet preview and a public download link tied to american-eye-manila.com<\/mark><\/strong>, a domain based in the Philippines<\/mark><\/strong>. The post carried a 06:30 timestamp on a public messaging channel and had 90 views and a handful of reactions when captured.<\/p>\n\n\n\n

The preview shows a CSV table with columns for person number, last name, first name, middle name and address. Black blocks cover both edges of the table, and the group’s red and gold emblem is stamped across the middle of the rows. This report rests on the post and the preview image only, so the real size and origin of the dataset are still open.<\/p>\n\n\n\n

What the Post Shows<\/h2>\n\n\n\n

The caption is short and reads like a trophy line. It says “Leaked By Karawang Error system,” names american-eye-manila.com as the target, and points to a file stored on a public file-sharing service. CyberAsia.io is not reproducing that link.<\/p>\n\n\n\n

\"Figure
Figure 1 : American Eye Manila data leak post from Karawang Error System showing a CSV table preview with name and address columns and a download link caption<\/figcaption><\/figure>\n\n\n\n

A 223.4 KB label sits in the corner of the preview image. It most likely describes the screenshot and not the CSV, so it is not the size of the dataset. Row numbers in the preview run to roughly 80, so the image shows only a small slice of the file.<\/p>\n\n\n\n

The column order looks like a registration or customer table, with an identifier first and name fields after it. The address column is cut off, so any further fields cannot be seen.<\/p>\n\n\n\n

Karawang Error System and the Shout-Out List<\/h2>\n\n\n\n

The emblem attached to the post is a red and gold roundel. An eagle that echoes Indonesian state heraldry holds a padlock on its shield, the group name runs along the top edge, and the motto “From Cyber to Security” runs along the bottom.<\/p>\n\n\n\n

\"Figure
Figure 2 : Karawang Error System logo, a red and gold emblem with an eagle holding a padlock and the motto From Cyber to Security<\/figcaption><\/figure>\n\n\n\n

Karawang is an industrial regency in West Java, and the name hints at an Indonesian base, though nothing in the post confirms where the operators sit. Public reporting under this exact name looks thin, so there is little track record to judge.<\/p>\n\n\n\n

The post closes with a block of shout-outs. It lists #CyberTeamIndonesia, #GorGorTideX, #Xh4kCyb3r, #RblLeviathanGhost, #Jax7, #SundaneseCyberThreat and #HadesCyberCrime, followed by #Jff, #kes and #rattler1337. Hashtag rolls like this are common in hacktivist posts. They usually signal friendship or borrow reach, and they are not proof that any of those crews took part.<\/p>\n\n\n\n

What Remains Unknown About the American Eye Manila Data Leak<\/h2>\n\n\n\n

Several basics are missing. The post does not say how the data was obtained, when it was taken, or how many records the file contains. It carries no ransom demand, no price and no deadline, and the link is offered openly. That fits a hack-and-leak post aimed at attention more than payment, though no motive is stated.<\/p>\n\n\n\n

Domain checks place american-eye-manila.com<\/mark><\/strong> in the Philippines, which fits the Manila name. They do not show who controls it, and public business directories list several eye care providers in Metro Manila under similar names. Registration records and direct contact with the site operator are the fastest ways to settle ownership.<\/p>\n\n\n\n

The data raises questions too. Many surnames in the visible rows read as common in English-speaking countries, which sits oddly beside a Philippine domain. That proves nothing on its own, but it leaves room for test data, merged records or foreign clients, and each would change the risk picture.<\/p>\n\n\n\n

Why a Names and Addresses File Still Matters<\/h2>\n\n\n\n

A list of names, home addresses and internal person numbers is enough to power convincing fraud, even without payment details. Scammers can pair such data with spoofed calls or texts that quote a real name and street. A message about an appointment or a billing error is hard for most people to dismiss.<\/p>\n\n\n\n

If the file does come from a health related provider, the sensitivity rises. Under Philippine law, health information counts as sensitive personal information, and even the fact that someone appears in a provider’s records can be private.<\/p>\n\n\n\n

Leak links bring a second risk. Files shared this way are often mirrored and bundled with malware, and people who go looking for their own details can end up infecting their devices or handling other people’s data.<\/p>\n\n\n\n

Philippine Privacy Rules and the 72-Hour Clock<\/h2>\n\n\n\n

The Philippines regulates personal data under the Data Privacy Act of 2012, Republic Act 10173<\/mark><\/a><\/strong>, and the National Privacy Commission<\/mark><\/a><\/strong> (NPC) enforces it. The NPC’s breach management circular, known as Circular 16-03, generally expects organizations to notify the Commission and affected individuals within 72 hours of learning, or reasonably believing, that a reportable breach has occurred.<\/p>\n\n\n\n

The strictest timing applies when a breach involves sensitive personal information or at least 100 people. A full report follows within five days unless the Commission grants more time. These duties fall on whoever controls the data, so the American Eye Manila data leak first needs an owner on record.<\/p>\n\n\n\n

Practical Steps for Organizations and Individuals<\/h2>\n\n\n\n

If the domain belongs to a real organization, the first hour matters most. A sensible order of work looks like this:<\/p>\n\n\n\n

    \n
  1. Confirm that the domain and exposed systems are the organization’s own, and preserve web server, database and firewall logs before anything changes.<\/li>\n\n\n\n
  2. Find the entry point, such as a web application flaw, an exposed database, reused credentials or a vendor, and close it.<\/li>\n\n\n\n
  3. Rotate passwords, API keys and database credentials, and require multi-factor authentication for administrators.<\/li>\n\n\n\n
  4. Ask the file-hosting service to remove the file, and watch for mirrors.<\/li>\n\n\n\n
  5. Notify the NPC and affected individuals within the required window.<\/li>\n<\/ol>\n\n\n\n

    For individuals who think they may be affected, the advice is simpler. Do not download the file. Treat unexpected calls, texts and emails that mention your name or address with suspicion, and verify through official contact details. Turn on multi-factor authentication for email and banking, and watch statements for unfamiliar activity.<\/p>\n\n\n\n

    The American Eye Manila data leak will stay a developing story until the domain owner or a regulator confirms what the file holds. For now, the post and its preview justify caution, not conclusions about the scale of any harm.<\/p>\n\n\n\n

    Read here : related CyberAsia.io article on hack-and-leak incidents in Southeast Asia.<\/mark><\/a><\/strong><\/p>\n\n\n\n

    FAQ<\/h2>\n\n\n\n

    Q1 : Is the American Eye Manila data leak confirmed as real?<\/mark><\/strong><\/p>\n\n\n\n

    Not from the screenshot alone. The post shows only a preview and a link, with no confirmation from the domain owner or the NPC. Treat the dataset as unconfirmed.<\/p>\n\n\n\n

    Q2 : Should I download the file to check the American Eye Manila data leak for my details?<\/mark><\/strong><\/p>\n\n\n\n

    No. Leak files can carry malware, and handling other people’s personal data can create legal problems. Ask the organization directly or wait for an official notice.<\/p>\n\n\n\n

    Q3 : What should the site owner do in the first 72 hours?<\/mark><\/strong><\/p>\n\n\n\n

    Preserve logs, contain the exposure, rotate credentials, request removal of the hosted file, and notify the NPC and affected individuals.<\/p>\n\n\n\n

    Q4 : How can people protect themselves from follow-on scams?<\/mark><\/strong><\/p>\n\n\n\n

    Do not trust unexpected messages that quote personal details. Call back through official numbers, never through links in the message, and enable multi-factor authentication.<\/p>\n\n\n\n

    Educational Notice<\/h2>\n\n\n\n

    This article is published for cyber security awareness and research. CyberAsia.io does not host or endorse access to leaked data, and readers should not download or redistribute the file.<\/p>\n\n\n\n

    <\/p>\n","protected":false},"excerpt":{"rendered":"

    The American Eye Manila data leak surfaced when a group calling itself Karawang Error System posted a spreadsheet preview and a public download link tied to american-eye-manila.com, a domain based in the Philippines. The post carried a 06:30 timestamp on a public messaging channel and had 90 views and a handful of reactions when captured. […]<\/p>\n","protected":false},"author":3,"featured_media":5421,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1025],"tags":[2853,2854,2859,1656,1184,2385,1188,13,2855,2743,21,2868,151,2856,566,1648,1478,1664,2866,2862,2857,2858,2864,2870,2860,2381,2863,2867,2865,1256,1987,2007,2774,1258,1263,1248,1245,1167,1160],"threat_actors":[661],"class_list":["post-5420","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-leak","tag-american-eye-manila","tag-american-eye-manila-data-leak","tag-arab","tag-berita-keamanan-siber","tag-ciberseguridad","tag-cyber-security-news","tag-cybersecurite","tag-data-breach","tag-data-privacy-act","tag-filtracion-de-datos","tag-hacktivist","tag-hindi","tag-indonesia","tag-indonesian-hacktivist","tag-karawang-error-system","tag-keamanan-siber","tag-kebocoran-data","tag-keselamatan-siber","tag-malay","tag-mandarin","tag-national-privacy-commission","tag-philippines-data-breach","tag-prancis","tag-rusia","tag-seguridad-sa-cyber","tag-siber-guvenlik","tag-spanyol","tag-tagalog","tag-urdu","tag-1256","tag---2","tag-2007","tag-2774","tag-1258","tag-1263","tag-1248","tag-1245","tag-1167","tag-1160","threat_actor-karawang-error-system-2"],"_links":{"self":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/comments?post=5420"}],"version-history":[{"count":2,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5420\/revisions"}],"predecessor-version":[{"id":5425,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/posts\/5420\/revisions\/5425"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media\/5421"}],"wp:attachment":[{"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/media?parent=5420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/categories?post=5420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/tags?post=5420"},{"taxonomy":"threat_actor","embeddable":true,"href":"https:\/\/cyberasia.io\/people\/wp-json\/wp\/v2\/threat_actors?post=5420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}