If you have an account on the Securities and Exchange Commission's (SEC) online platforms, eight pieces of your personal data, including your birth date, home address and Tax Identification Number (TIN), may now be in the wrong hands. Separately, the Bureau of Internal Revenue (BIR) is checking a claim that records of about 10 million taxpayers were stolen. Here is what each agency has actually confirmed about the BIR and SEC data leak, and the steps you can take this week.
What the SEC has confirmed
The SEC posted a preliminary advisory on November 7, then confirmed on November 9 that it was dealing with a data security incident, which it dates to November 6. In its statement, carried by the Philippine News Agency, the SEC said its initial findings show:
- No company records were affected.
- No passwords were leaked, and no data was changed.
- Its internal database is intact.
- But some individual profile information may have been exposed. The SEC is still checking where the data came from, how much is involved and whether it is real.
The SEC also sent notices to affected account holders. According to Fintech News Philippines, the details that may be exposed are:
- full name and username
- email address and mobile number
- date of birth and gender
- home address
- TIN
The SEC has not said how many users are affected. It says it has reported the incident to the National Privacy Commission (NPC). It says it has reinforced access controls and updated authentication of credentials, and is running security scans, digital forensics (tracing how an attack happened) and a system-wide audit.
What the BIR has and has not confirmed
The BIR story is still a claim. A monitoring group called Deep Web Konek reported that a hacker using the name "Happy Go Lucky PH" says it took about 10 million individual taxpayer records and about 500,000 corporate records, eSecurity Planet reported.
The BIR has not confirmed a breach. It has not said what data may be involved, how many people could be affected, or how anyone got in. It says it is working with the Cybercrime Investigation and Coordinating Center (CICC) and the DICT's National Computer Emergency Response Team (NCERT), and it has told taxpayers to deal with it only through official channels.
An earlier report from Gulf News said the BIR had also tightened security and brought in the PNP Anti-Cybercrime Group. The same report notes that in September the BIR had a brief website defacement, which it said did not touch taxpayer data. The BIR has not linked that incident to this claim.
SEC and BIR incidents side by side
| SEC | BIR | |
|---|---|---|
| Status | Incident confirmed | Claim under investigation |
| Size | Not disclosed | About 10 million personal and 500,000 corporate records (hacker's claim) |
| Data at risk | Name, username, email, mobile, birth date, gender, address, TIN | Not disclosed |
| Passwords | SEC says none leaked | Not stated |
| Who is involved | NPC notified | CICC and DICT-NCERT |
Why a leaked TIN and birth date matter
You do not need to lose a password to be at risk. With your real name, address, birth date and TIN, a scammer can write a message that looks like it came from the BIR or SEC. eSecurity Planet points out that real taxpayer details make tax-themed phishing (fake messages that trick you into giving up money or logins) far more convincing, and that the BIR has warned before about fake emails that lead to copycat login pages.
So a message that quotes your correct TIN is not proof that it is real.
The NPC said on November 6 that it had not yet received breach notifications from the agencies involved, and that a leak claim alone does not prove a breach. Under Philippine rules, an organization must notify the NPC and the affected people within 72 hours once it knows, or has good reason to believe, that a reportable breach happened.
How to protect your SEC and BIR accounts
The SEC urges the public to take standard security precautions. These general steps fit that advice, plus the BIR's own instruction to use official channels:
- Change your SEC password, and change it on any other account where you used the same one.
- Turn on multifactor authentication (a second check, such as a code sent to your phone) wherever you can.
- Never share a password, security PIN or login code. The SEC says it does not ask for passwords or security PINs.
- Do not click links in tax or SEC messages. For tax matters, go only through the BIR's official website and channels, typing the address yourself.
- Ask the SEC directly if you think your data was involved. Its Data Protection Officer is Oliver V. Chato.
- Report scam texts and emails that use your details. Our guide on every way to report a scam text in the Philippines lists the channels.
What happens next
The SEC says its investigation is still checking the origin, scope and validity of the leaked dataset. The BIR has not given a date for its findings. This is the latest in a run of claimed government leaks this year, including the LTFRB breach in September, where a large record count also went unverified at first.
