The recent data breach at the Philippine Health Insurance Corporation (PhilHealth) may have affected up to 20 million of its members, an official from the state insurer claimed Wednesday (October 18).

In a press conference, Data Privacy Officer Nerissa Santiago told media that the names of between 13 million to 20 million PhilHealth members were leaked following the Medusa ransomware attack that hit the agency last month.

The National Privacy Commission (NPC) previously estimated that around one million PhilHealth identification numbers were dumped online after the government refused to pay a $300,000 (Php 17 million) ransom to hackers. PhilHealth has not identified the perpetrators of the attack, but an initial investigation by the Department of Information and Communications Technology (DICT) concluded that it was not an inside job.

“[T]here is high probability that it’s even from outside the country, ” PhilHealth Executive Vice President and Chief Operating Officer Eli Dino Santos said during the press conference, according to a report by the Philippine Star.

Seven PhilHealth executive officers have been reassigned for “incompetence” following the breach, according to Health Secretary Ted Herbosa. The NPC, which has launched a probe to determine the full extent of the Medusa cyberattack, warned that PhilHealth officials could face legal prosecution for any uncovered negligence.

Curious whether or not you were among the people affected by the PhilHealth data breach? Check out our guide on how to use the NPC’s “Na-leak ba ang PhilHealth Data ko?” online portal. Just take note, the NPC makes it clear that a negative result on the site doesn’t necessarily mean none of your data was leaked.

PhiHealth has advised those who are confirmed to have been affected to follow a set of guidelines it has released. Their safety measures range from something as simple as changing passwords to completely canceling credit cards.