MANILA, Philippines — The Bureau of Internal Revenue (BIR) has acknowledged that certain taxpayer profile information may have been exposed during cybersecurity incidents reported on November 6 and 7, while assuring the public that its initial findings show no compromise of tax filing and payment records.

In an advisory issued on November 10, the bureau said it had immediately taken steps to preserve evidence, prevent further exposure and determine the scope of the affected records.

The BIR maintained that the integrity of its internal database infrastructure and systems remained intact, adding that no taxpayer information had been modified or lost and that records involving tax filings and payments had not been compromised.

However, the agency acknowledged that initial findings indicated that certain taxpayer profile information may have been exposed.

The bureau is working with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology's National Computer Emergency Response Team (DICT-NCERT) to determine the source and extent of any unauthorized access.

The BIR also confirmed that it had notified the National Privacy Commission (NPC) in accordance with existing laws and regulations.

BIR strengthens access controls as investigation continues

As part of its response, the BIR said it was strengthening system access controls and testing remediation measures to address identified vulnerabilities.

The agency is also conducting a Privacy Impact Assessment to evaluate the incident and the possible exposure of taxpayer information.

The investigation follows an initial advisory issued on November 9, when the bureau said it was addressing online claims of cybersecurity breaches in coordination with CICC and DICT-NCERT.

At that time, the BIR did not confirm whether taxpayer information had been exposed, saying only that immediate measures had been implemented to assess the situation and protect its systems and taxpayer data.

Its November 10 advisory subsequently acknowledged the possibility that certain taxpayer profile information had been exposed, although the agency did not identify the specific records or information fields involved.

Alleged millions of taxpayer records remain unverified

The BIR's acknowledgment followed claims circulated by cybersecurity monitoring group Deep Web Konek, which attributed an alleged data extraction to a threat actor operating under the handle “Happy Go Lucky PH.”

According to Deep Web Konek's monitoring, the threat actor claimed to have obtained more than 10 million individual taxpayer records and 500,000 corporate records.

The BIR has not publicly established whether the datasets cited in the online claims correspond to the cybersecurity incidents it acknowledged, nor has it confirmed the authenticity or completeness of the purportedly extracted records.

The bureau has also yet to identify which taxpayer profile fields may have been exposed or specify the systems involved.

CICC says vulnerabilities have been remediated

CICC Executive Director Renato Paraiso said the vulnerabilities exploited in the BIR and Securities and Exchange Commission (SEC) incidents had been contained and remediated.

However, investigators are still examining the datasets being circulated online to determine whether they contain newly extracted information or previously leaked records being presented as evidence of recent breaches.

Paraiso also said authorities were working to identify the individuals responsible for the alleged attacks.

The distinction between resolving technical vulnerabilities and completing the investigation remains important: remediation addresses the identified weaknesses, while investigators continue to establish the origin of the incidents and the authenticity of the purportedly stolen information.

BIR among 10 government agencies that notified privacy regulator

The BIR incident is part of a wider series of reported cybersecurity incidents involving Philippine government institutions.

The NPC confirmed on November 10 that it had received personal data breach notifications from 10 government agencies, including the BIR, SEC, DICT, Presidential Commission on Good Government, Department of Labor and Employment's Bureau of Local Employment, Philippine Amusement and Gaming Corporation, Department of Justice, Philippine Coast Guard, Department of Trade and Industry, and the Department of Science and Technology's Philippine Institute of Volcanology and Seismology.

The commission said these notifications allow it to assess reported incidents and determine the appropriate regulatory response.

It emphasized that submitting a breach notification is an important part of the regulatory process under the Data Privacy Act of 2012.

BIR urges taxpayers to strengthen account security

While its investigation continues, the BIR has advised taxpayers to take precautionary measures to protect their accounts.

The agency recommends updating account credentials and passwords, enabling multi-factor authentication where available, and regularly monitoring account activity for unauthorized transactions or unusual alerts.

It also urged the public to remain vigilant against phishing attempts and other fraudulent communications, and to conduct transactions exclusively through the bureau's official channels and platforms.

Taxpayers with related inquiries may contact the BIR's Data Protection Officer through bir_dpo@bir.gov.ph.

The bureau said it would continue its privacy assessment and remediation efforts as it works with cybersecurity authorities to establish the source and extent of the possible exposure.

‍