The Bureau of Internal Revenue (BIR) now says some taxpayer profile information may have been exposed in a cyberattack, and it is one of 10 government agencies that have filed data breach notices with the National Privacy Commission (NPC). If you have a TIN, expect more tax-themed scam messages, and treat any message that quotes your details with extra care.
This is a change from two days ago. When we covered the BIR leak claim and the SEC breach on November 10, the BIR had not confirmed anything. Its new advisory admits a possible exposure, but it still has not said how many taxpayers or which data are involved.
We could not open the BIR advisory itself. The details below come from several outlets that reported it, and they agree on the main points.
What the BIR data breach advisory says
On Tuesday, November 10, the BIR said that "certain taxpayer profile information may have been exposed" in cybersecurity incidents reported on November 6 and 7, Philstar Tech reported. According to the BIR's initial findings:
- No taxpayer information was changed or lost, and no filing or payment records were compromised.
- Its internal database infrastructure and systems "remain intact".
- It has kept evidence and taken steps to stop further exposure.
The BIR has not said which taxpayer details were exposed, how many taxpayers may be affected, or how the attacker got in, Back End News noted.
The agency is running a forensic investigation (tracing how the attack happened) with the Cybercrime Investigation and Coordinating Center (CICC) and the DICT's National Computer Emergency Response Team. It has notified the NPC. It says it is tightening access controls, testing fixes and doing a privacy impact assessment, which measures the risk to affected taxpayers, BusinessMirror reported.
The 10 million record claim is still unproven
The size of the leak comes from the attacker's side, not the BIR. A monitoring group, Deep Web Konek, said a hacker using the name "Happy Go Lucky PH" took about 10 million individual taxpayer records and about 500,000 corporate records, eSecurity Planet reported. BusinessMirror says the files are said to include government-issued IDs, selfies, general tax information and company documents such as Articles of Incorporation.
The BIR has not confirmed these numbers or this list of files. What it has confirmed is narrower: some profile data may have been seen by someone without permission.
| Before (Nov 7 to 9) | Now (Nov 10 advisory) | |
|---|---|---|
| BIR position | Checking a claim, no breach confirmed | Profile data may have been exposed |
| Filing and payment records | Not stated | Not compromised, per initial findings |
| Number affected | Hacker claims about 10 million | Not disclosed |
| Working with | CICC and DICT-NCERT | CICC and DICT-NCERT; NPC notified |
Which agencies have filed breach notices with the NPC?
As of November 10, the NPC said it had received personal data breach notifications from these agencies, per Philstar Tech's list and BusinessMirror's count of the BIR plus nine others:
- Bureau of Internal Revenue (BIR)
- Securities and Exchange Commission (SEC)
- Department of Information and Communications Technology (DICT)
- Presidential Commission on Good Government (PCGG)
- Department of Labor and Employment, Bureau of Local Employment
- Philippine Amusement and Gaming Corporation (Pagcor)
- Department of Justice, Office for Alternative Dispute Resolution
- Philippine Coast Guard
- Department of Trade and Industry (DTI)
- Department of Science and Technology, through Phivolcs
The NPC has not said how many people are affected across these incidents, what data was involved, or whether the incidents are linked. It reminded agencies that they stay accountable for personal data even when a contractor handles it.
What a real breach notice must tell you
The Data Privacy Act sets out what an agency owes you. Under Section 20(f) of Republic Act 10173, an organization must promptly notify the NPC and the affected people when sensitive personal information, or data that could enable identity fraud, is reasonably believed to have been taken, and the theft is likely to cause real risk of serious harm.
The law says that notice must at least describe:
- the nature of the breach;
- the sensitive personal information possibly involved; and
- the measures the agency took to address it.
Notice may be delayed only as long as needed to find the scope of the breach, stop further leaks, or restore the system. So if your data was involved, you may still receive a notice from the BIR or another agency. A genuine notice explains what happened. A message that asks you to log in through a link, pay a fee or share a one-time PIN is not one of the three things the law lists, so verify it before you act.
What taxpayers should do now
The BIR's own advice, as reported by BusinessMirror and Back End News:
- Update your passwords for BIR online accounts.
- Turn on multi-factor authentication (a second check, such as a code sent to your phone) where it is available.
- Watch your accounts for unfamiliar transactions or alerts.
- Be wary of phishing: fake emails and texts that try to get money or logins from you.
- Transact only through the BIR's official channels and platforms.
For questions about your data, the BIR's data protection officer can be reached at bir_dpo@bir.gov.ph, per BusinessMirror. If you get a scam text that uses your tax details, our guide on every way to report a scam text in the Philippines lists the hotlines and portals.
The BIR has not given a date for its final findings, and the NPC has not said when it will finish assessing the 10 notifications.
