A hacked business social media page can cause damage within minutes: scammers may message customers, change payment instructions, run unauthorized advertisements, steal customer information, or remove every legitimate administrator. The safest response is to treat the incident as three problems at once—an account-recovery emergency, a possible cybercrime, and, if customer or employee information was exposed, a potential personal data breach.

What Counts as a Hacked Business Social Media Page?

A business page is compromised when someone gains access or control without authority. Common examples include:

A hacker takes over the personal account of a Facebook Page administrator.
An attacker adds themselves to Meta Business Manager or a business portfolio.
A former employee keeps using access after authority has been withdrawn.
Someone changes the page’s email address, phone number, password, username, or administrators.
The page sends fraudulent payment instructions or loan offers.
Unauthorized advertisements are charged to the business’s card.
Customer messages, order details, IDs, addresses, or payment information are viewed or downloaded.
The hacker deletes posts, alters business information, or threatens to destroy the page unless paid.

Not every loss of access is technically “hacking.” Sometimes the problem is an ownership dispute between business partners, an employee who was never formally removed, or a page created under another person’s account. The distinction matters because platforms and investigators will look for documents showing who owned the business, who created or managed the page, and when the disputed access became unauthorized.

Philippine Laws That May Apply

Cybercrime Prevention Act of 2012

The principal criminal law is Republic Act No. 10175, or the Cybercrime Prevention Act of 2012.

Depending on what the intruder did, the incident may involve:

Illegal access under Section 4(a)(1), meaning access to a computer system or part of it without right.
Data interference under Section 4(a)(3), when computer data is intentionally or recklessly altered, deleted, damaged, or deteriorated without authority.
Computer-related fraud under Section 4(b)(2), when unauthorized input, alteration, deletion, or system interference causes damage and is done with fraudulent intent.
Computer-related identity theft under Section 4(b)(3), which covers unauthorized acquisition, use, misuse, transfer, alteration, or deletion of identifying information belonging to a natural or juridical person. A corporation or registered business can therefore be the victim of identity-related misuse.
Other offenses committed through information and communications technology, including estafa, threats, falsification, or libel, depending on the hacker’s conduct.

In Disini v. Secretary of Justice, the Supreme Court largely upheld the provisions covering illegal access, data interference, computer-related fraud, and computer-related identity theft. (Lawphil)

Data Privacy Act of 2012

A page takeover becomes a data privacy issue when the intruder may have accessed personal data belonging to customers, employees, suppliers, or page administrators.

Examples include:

Customer names, addresses, contact numbers, and order histories
Private messages containing IDs or proof of payment
Employee records or schedules
Login credentials
Bank, e-wallet, credit card, or financial information
Government-issued identification numbers
Health, educational, marital, or other sensitive personal information

Under Republic Act No. 10173, or the Data Privacy Act of 2012, organizations that control personal information must implement reasonable organizational, physical, and technical security measures. Unauthorized access to systems containing personal and sensitive personal information may also be punishable under Section 29. (Lawphil)

The business page itself, its branding, and purely corporate information are not necessarily “personal data.” The Data Privacy Act principally protects information relating to identifiable individuals. However, page inboxes, lead forms, customer databases, advertising audiences, and administrator accounts often contain protected information.

Civil liability for losses and reputational harm

An identifiable perpetrator may also be civilly liable under Articles 19, 20, and 21 of the Civil Code. These provisions require people to act with justice, honesty, and good faith and require compensation when a person unlawfully or wrongfully causes loss or injury to another.

Possible recoverable losses may include unauthorized advertising charges, refunded fraudulent payments, forensic expenses, lost sales, restoration expenses, and other damages that can be proved with reliable records. The claimant must still establish the wrongful act, the identity and participation of the defendant, actual damage, and the connection between the act and the loss. (Lawphil)

What to Do Immediately After Discovering the Hack

1. Preserve evidence before cleaning everything up

Take screenshots and screen recordings showing:

The page name, username, URL, and page ID
Unauthorized posts, advertisements, messages, and profile changes
Names or profiles of newly added administrators
Login alerts and password-reset emails
Changes to the registered email address or mobile number
Messages from the hacker, including ransom demands
Fraudulent bank or e-wallet instructions
Customer complaints and reports
Unauthorized ad charges or payment transactions
The date and exact time each event was discovered

Save the original emails rather than relying only on screenshots. Download them in their original format when possible. Keep copies of suspicious attachments, but do not open them on an ordinary business device.

Create a written incident timeline. Record who discovered the incident, what they observed, which actions were taken, and at what time. Avoid editing original files because authenticity and integrity can become important if electronic evidence is later presented in an investigation or court proceeding. The Philippine Rules on Electronic Evidence govern the use and authentication of electronic documents and data messages. (Lawphil)

2. Secure the email account and mobile number first

Social media recovery usually depends on the administrator’s email address, phone number, or authentication app. If the hacker controls the email account, simply resetting the social media password may not solve the problem.

From a clean device:

Change the email password.
Sign out all other email sessions.
Remove unknown recovery addresses, phone numbers, forwarding rules, and application passwords.
Enable multi-factor authentication using an authenticator app or security key where available.
Contact the telecommunications provider if the SIM suddenly stopped working or may have been replaced.
Change passwords on any other account that used the same or a similar password.

Do not conduct recovery from a device that may still contain malware. Update the operating system, run a reputable security scan, and remove unknown browser extensions or remote-access programs.

3. Stop unauthorized payments and advertisements

Immediately review:

Social media advertising accounts
Saved credit and debit cards
Bank and e-wallet accounts
Online payment gateways
Linked e-commerce stores
Third-party scheduling, chatbot, analytics, and marketing applications

Pause advertisements and remove compromised payment methods when possible. Report unauthorized transactions to the bank, card issuer, e-wallet provider, and social media platform immediately. Ask for a reference or dispute number and keep the acknowledgement.

Do not wait for page recovery before reporting financial transactions. Banks and payment providers apply their own investigation periods and may need prompt notice to stop or trace funds.

4. Use only the platform’s official recovery process

Avoid people who claim they have an “inside contact” and demand payment to retrieve the page. Many victims lose additional money or expose more credentials to fake recovery agents.

For Facebook and Instagram:

Start with Facebook’s hacked-account recovery process, preferably using a device previously used to access the account.
Use Meta’s procedure to recover a hacked Facebook Page.
If a business portfolio or Business Manager was compromised, use the Meta business portfolio recovery process.
For Instagram, use the Instagram hacked-account recovery page.

Meta specifically recognizes that a scammer may take over a Page through a compromised administrator, Business Manager, or business portfolio. The Department of Justice has also published Facebook account retrieval guidance directing victims to Meta’s recovery mechanisms. (Facebook)

Use a business-controlled email address for the recovery case. Save every case number, automated reply, upload receipt, and identity-verification request. Submit consistent information; multiple contradictory reports can slow verification.

5. Warn customers through another verified channel

If the hacker is messaging customers or posting payment instructions, publish an alert through channels the business still controls, such as:

The official website
Another verified social media account
Email or SMS
The physical store
Google Business Profile
Marketplace or e-commerce storefronts

A useful alert should identify the affected page, state when unauthorized activity began, tell customers not to send money or personal information, provide the business’s legitimate payment details, and explain where customers can verify announcements.

Do not publicly accuse a named person unless the evidence is reliable. A mistaken accusation can create a separate defamation or privacy problem.

6. Remove unauthorized access after control is restored

Changing one password is not enough. Review the entire access chain:

Page administrators and roles
Business portfolio users and partners
Advertising account users
Linked Instagram, WhatsApp, Messenger, and commerce accounts
Third-party applications
Active sessions and remembered devices
Recovery email addresses and phone numbers
API tokens, chatbot connections, and marketing integrations
Automatic email forwarding rules
Two-factor authentication settings

Remove dormant employees, agencies, freelancers, and former business partners who no longer need access. Require each administrator to use an individual account; shared passwords make it difficult to identify who took an action.

Determine Whether Personal Data Was Compromised

A personal data breach includes unauthorized access, disclosure, alteration, loss, or destruction of personal data. The National Privacy Commission classifies breaches as confidentiality, integrity, or availability breaches. (National Privacy Commission)

Ask the following questions:

Could the hacker read customer or employee messages?
Did the page contain uploaded IDs, receipts, addresses, phone numbers, or account details?
Could lead-form data or customer lists have been exported?
Were usernames, passwords, authentication details, or administrator information exposed?
Did the hacker alter records or send messages pretending to be the business?
How many people may be affected?
Is there a real risk of identity theft, financial fraud, harassment, or serious reputational harm?

Document the assessment even if the answer is that mandatory notification is not required.

When Must the National Privacy Commission Be Notified?

Not every hacked page requires a mandatory breach notification. According to the NPC, notification is mandatory when all three of the following are present:

The compromised data includes sensitive personal information or information that could enable identity fraud, such as login credentials, financial information, biometrics, government IDs, or unique identification numbers.
There is reason to believe an unauthorized person acquired the information.
The breach is likely to create a real risk of serious harm to affected individuals.

When those conditions exist, the personal information controller must generally notify the NPC and affected data subjects within 72 hours from knowledge of, or reasonable belief that, the personal data breach occurred. An initial notification may be based on information available at the time; the full report is generally due within five days unless the NPC allows additional time. (National Privacy Commission)

Notifications are submitted through the NPC’s Data Breach Notification Management System. The report should explain the breach, affected information, likely consequences, number and type of affected individuals, containment measures, recovery efforts, and steps taken to prevent recurrence.

Affected individuals must generally be notified individually by written or electronic means. The notice should explain what happened, what information was involved, what risks may result, what the business has done, and what the individual should do to protect themselves.

If the incident does not meet the mandatory-notification test, the business should still document it. The NPC requires covered personal information controllers and processors to include security incidents and breaches in the Annual Security Incident Report submitted through the DBNMS for the preceding calendar year. (National Privacy Commission)

Failure to make a required notification may lead to administrative fines. Intentional concealment of a breach involving sensitive personal information may also carry criminal penalties under Section 30 of the Data Privacy Act. (National Privacy Commission)

How to Report the Hack to Philippine Authorities

NBI Cybercrime Division

The National Bureau of Investigation accepts complaints involving computer crimes through its Cybercrime Division and regional cybercrime offices.

The NBI’s published procedure includes:

Filing a complaint sheet.
Undergoing a preliminary interview.
Executing a sworn complaint or submitting a prepared affidavit.
Providing supporting documents and devices relevant to the investigation.

The NBI Citizens’ Charter lists no fee for complaint intake and gives an indicative intake-processing period of approximately one hour and ten minutes. This does not include the time required for the actual investigation, forensic examination, identification of the suspect, warrant applications, or prosecution. (National Bureau of Investigation)

The NBI Cybercrime Division can be contacted through the official NBI directory. Its currently published email address is ccd@nbi.gov.ph. (National Bureau of Investigation)

PNP Anti-Cybercrime Group

A complaint may also be filed with the Philippine National Police Anti-Cybercrime Group at Camp Crame or through the appropriate regional anti-cybercrime office. The DOJ’s account-retrieval guidance expressly directs cybercrime complainants to either the NBI Cybercrime Division or PNP Anti-Cybercrime Group. (Cybercrime Division)

A barangay blotter is not a prerequisite before reporting a hacked business page to the NBI or PNP. The incident may be reported directly to the cybercrime authorities.

CICC Hotline 1326

The Cybercrime Investigation and Coordinating Center operates the government’s 1326 anti-scam and cybercrime hotline. Reports may also be submitted through the CICC reporting portal. The hotline operates around the clock and can provide guidance, coordinate referrals, and connect complainants with relevant agencies. (Philippine News Agency)

Why early reporting matters

Social media platforms may hold subscriber information, login records, IP data, and other records that ordinary users cannot obtain. Under RA 10175 and the Rules on Cybercrime Warrants, law enforcement may seek court-authorized disclosure, search, seizure, examination, or preservation of relevant computer data.

Service providers are subject to legal preservation rules, but businesses should not assume that every platform record will remain available indefinitely. Early reporting gives investigators a better opportunity to seek preservation before relevant information is deleted or overwritten. (Lawphil)

Documents and Evidence to Prepare

Document or evidence	Why it matters
Government-issued ID of the complainant	Establishes the complainant’s identity
DTI, SEC, CDA, or other business registration	Shows the legal identity of the business
BIR Certificate of Registration and local permits	Supports the business’s operational identity
Board resolution or secretary’s certificate	Shows authority to act for a corporation
Special power of attorney	Authorizes a representative when the owner or officer cannot personally appear
Page URL, username, page ID, business portfolio ID, and ad account ID	Identifies the exact digital assets
Original page-creation and registration emails	Helps prove historical control
Screenshots, screen recordings, and original emails	Shows unauthorized activity and timing
Platform case numbers and replies	Proves that recovery was attempted
Bank, card, e-wallet, and advertising statements	Documents financial loss
Customer complaints and payment receipts	Shows scams committed through the page
Employee access records and contracts	Clarifies who had legitimate authority
Incident timeline and sworn statements	Organizes the facts for investigators
Affected-data inventory	Supports the NPC breach assessment

Bring originals when available, together with organized copies. Label files by date and source. A clear evidence folder usually helps more than hundreds of unsorted screenshots.

Business Owners and Foreigners Who Are Outside the Philippines

An owner or corporate officer abroad may need to authorize a Philippine representative through a special power of attorney, board resolution, or secretary’s certificate, depending on the business structure and the receiving agency’s requirements.

A private document such as an affidavit or SPA executed in an Apostille Convention country may generally be notarized locally and apostilled by that country’s competent authority for use in the Philippines. Another option may be execution before a Philippine embassy or consulate. Documents from non-Apostille countries may require consular legalization or another authentication process specified by the relevant Philippine foreign service post. (Philippine Embassy in New Delhi)

Platform recovery can usually be started from abroad, but Philippine complaint proceedings may require a sworn affidavit, authenticated corporate documents, and a local representative who can coordinate with investigators.

Common Mistakes That Make Recovery Harder

Paying a “recovery expert” who asks for passwords

Legitimate platforms do not require you to give an unknown person your password, one-time PIN, authentication code, or remote access to your computer.

Deleting evidence immediately

Removing a fraudulent post may protect customers, but capture it first. Save the URL, timestamp, screenshots, messages, and related payment instructions before deletion whenever safely possible.

Securing the social media page but not the email

An attacker who still controls the recovery email can take the page again.

Creating a new page and abandoning the complaint

A replacement page may keep the business operating, but it does not stop the original page from impersonating the business or scamming customers.

Treating every former employee as a hacker

Investigators will examine whether access was clearly revoked and whether the person knowingly acted without authority. Keep termination records, access-removal instructions, confidentiality agreements, and administrator logs.

Missing the 72-hour privacy deadline

A business does not need a complete forensic report before submitting an initial mandatory notification. When the reporting test is met, the NPC permits an initial report based on information available within the 72-hour period. (National Privacy Commission)

Making vague public announcements

A post saying only “We were hacked” does not tell customers what to avoid. State which page is affected, the approximate period of unauthorized activity, whether payment instructions were altered, and where official updates can be verified.

Frequently Asked Questions

Can I file a criminal case if no money was stolen?

Yes. Illegal access and certain other cybercrime offenses do not necessarily require a completed financial loss. Unauthorized access itself may be punishable, while attempted fraud or identity misuse may also create liability depending on the evidence.

Is a hacked Facebook business page automatically a data breach?

No. It becomes a personal data breach when personal data was accessed, disclosed, altered, lost, or destroyed. A page containing only public business information may not trigger mandatory NPC notification, but private messages, lead forms, customer records, and administrator credentials can change the analysis.

Do I have to notify the NPC within 72 hours?

Only when the conditions for mandatory notification are met. The 72 hours generally run from knowledge of, or reasonable belief that, a qualifying personal data breach occurred—not necessarily from the exact moment the hacker first entered the account.

Should I pay the hacker to return the page?

Payment provides no assurance that access, copied information, or hidden administrator privileges will be returned. It may also encourage further demands. Preserve the demand, secure connected accounts, use the platform’s official process, and report the incident.

Can the NBI or PNP recover my Facebook page?

Law enforcement can investigate the crime and seek preservation or disclosure of evidence through proper legal processes. Actual restoration of the page normally remains subject to the platform’s account-recovery and ownership-verification procedures.

How long does recovery take?

There is no guaranteed recovery period. Simple password compromises may be resolved quickly, while cases involving removed administrators, altered business portfolios, identity verification, or competing ownership claims can take much longer. Delays often arise from incomplete ownership documents, inconsistent submissions, compromised email accounts, and unresolved access by former personnel.

What if the hacker scammed my customers?

Warn customers immediately, preserve the conversations and payment instructions, and ask affected customers to keep their receipts and report their transactions to their bank, e-wallet provider, or law enforcement. The business should maintain a verified list of reported victims and avoid deleting relevant messages after they have been preserved.

What if the page was created using an employee’s personal account?

Prepare evidence showing that the page was created and operated for the business, including employment contracts, reimbursement records, advertising payments, brand assets, instructions, and administrator history. Platform recovery may become harder when ownership and control were never documented.

Do I need a notarized affidavit?

The NBI process may involve a complaint sheet sworn to by the complainant or a prepared affidavit. A corporation may also need documents showing that the signatory is authorized. Notarization and authentication requirements depend on where the document is executed and which agency will receive it.

Should the business notify every follower?

Not necessarily. Public warnings should target people who may encounter fraudulent posts or payment requests. Formal individual data-breach notification is required for affected data subjects when the legal notification conditions are present. A general social media announcement does not automatically replace individual notification.

Key Takeaways

Preserve screenshots, original emails, transaction records, URLs, and a detailed timeline before removing fraudulent content.
Secure the administrator’s email, phone number, devices, payment accounts, and third-party applications—not just the social media password.
Use only official platform recovery channels and keep every case number and acknowledgement.
Warn customers promptly if the page is sending fraudulent messages or payment instructions.
Assess whether customer, employee, or administrator personal data was accessed.
Notify the NPC and affected individuals within 72 hours when all mandatory breach-notification conditions are present.
Report serious incidents promptly to the NBI Cybercrime Division, PNP Anti-Cybercrime Group, or CICC Hotline 1326.
Prepare business registrations, proof of authority, page identifiers, financial records, sworn statements, and organized electronic evidence.
After recovery, remove unauthorized users, revoke third-party access, require individual administrator accounts, and enable strong multi-factor authentication.