The personal information of more than 50 million Filipinos has been exposed in a breach of the Philippine electoral commission.

According to security researchers at Trend Micro, the hack contains a huge amount of very sensitive personal data, including the fingerprints of 15.8 million individuals and passport numbers and expiry dates of 1.3 million overseas voters.

The website of the Commission on Elections, Comelec, was initially hacked on March 27, by a group identifying itself as Anonymous Philippines, the local fork of the wider hacker collective. The homepage was defaced with a message accusing Comelec of not doing enough to ensure the security of voting machines used in the country’s upcoming election.

“One of the processes by which people exercise their sovereignty is through voting in an election,” the message read. “But what happens when the electoral process is so mired with questions and controversies? Can the government still guarantee that the sovereignty of the people is upheld?”

The same day, a different but related group, LulzSec Pilipinas, posted an online link to what it claimed was the entire database of Comelec. The 338GB database contains 75.3m individual entries on the electoral register, with 54.28m of them not tagged as disapproved – about the same number as the 54.36 million registered voters in the Philippines.

That makes this hack potentially the “biggest government related data breach in history”, according to Trend Micro, “surpassing the Office of Personnel Management (OPM) hack last 2015 that leaked PII, including fingerprints and social security numbers (SSN) of 20 million US citizens.”

It even exceeds last week’s record-breaking release of personal information from the Turkish citizenship database, which contained records on 49 million people, the population of half the country.

Trend Micro warns that the Philippine hack leaves citizens open to risk from crime. “Cybercriminals can choose from a wide range of activities to use the information gathered from the data breach to perform acts of extortion. In previous cases of data breach, stolen data has been used to access bank accounts, gather further information about specific persons, used as leverage for spear phishing emails or BEC schemes, blackmail or extortion, and much more.”

In a statement given in late March, Comelec downplayed the effect of the hack. “I want to emphasise that the database in our website is accessible to the public. There is no sensitive information there. We will be using a different website for the election, especially for results reporting and that one we are protecting very well,” a spokesman said. But Trend Micro says its investigations “showed a huge number of sensitive personally identifiable information (PII)–including passport information and fingerprint data–were included in the data dump.”