The Bureau of Internal Revenue (BIR) is coordinating with government cybersecurity agencies following allegations that a threat actor gained unauthorized access to more than 10 million individual taxpayer records, along with corporate and business information.
In an advisory issued at noon on Monday, Nov. 9, the BIR said it was working with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology-National Computer Emergency Response Team (DICT-NCERT) to address the reported cybersecurity incident.
“The Bureau of Internal Revenue (BIR) informs taxpayers that claims of cybersecurity breaches are currently being addressed in coordination with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology-National Computer Emergency Response Team (DICT-NCERT),” the agency said.
The advisory came amid allegations circulated by cybersecurity monitoring group Deep Web Konek concerning a threat actor identified as Happy Go Lucky PH, which claimed to have obtained a large volume of information from the BIR’s taxpayer registration systems.
According to the claims, the alleged compromised dataset contains records belonging to more than 10 million individuals, while additional corporate and business information is reportedly being collected.
The information allegedly includes individual taxpayer records, corporate registration details, business records, and other data associated with registered taxpayers.
However, the authenticity of the alleged dataset, the number of affected taxpayers, and the extent of any unauthorized access have not been independently verified.
The BIR’s advisory did not confirm that a breach had occurred or specify whether taxpayer information had been compromised.
The allegations have also renewed scrutiny of the agency’s Correspondence Verification Portal and its QR-based Registration Seal Badge, which previously drew criticism over concerns about the public accessibility of taxpayer verification information.
Questions have been raised about whether the portal’s backend infrastructure, connected services, and taxpayer databases have sufficient safeguards against unauthorized access.
The controversy comes after the BIR suspended the mandatory online display of its registration badge through Revenue Memorandum Circular No. 113-2026, issued on Oct. 26.
However, no evidence has been established linking the alleged cybersecurity incident to the verification portal or the registration badge system.
Cybersecurity concerns surrounding the alleged incident extend beyond the possible disclosure of taxpayer registration information.
If confirmed, a breach involving millions of individual and corporate records could expose taxpayers and businesses to identity theft, targeted phishing attacks, financial fraud, corporate impersonation, and fraudulent tax-related transactions.
Compromised registration documents and identifying information could also be exploited by cybercriminals to impersonate legitimate businesses or deceive taxpayers through fraudulent communications.
In its advisory, the BIR said it had already implemented measures to assess the situation and protect its information systems.
“The BIR remains committed to strengthen its cybersecurity posture. Immediate response measures have been implemented to assess the situation and protect the security and integrity of its systems and taxpayer data,” the agency said.
The BIR also advised taxpayers and businesses to remain vigilant and conduct transactions exclusively through its official channels and platforms.
The agency said further updates would be issued as information becomes available.
The allegations could also warrant an examination by the National Privacy Commission (NPC) to determine whether personal information was exposed and whether notification requirements under the Data Privacy Act apply.
As of the BIR’s Nov. 9 advisory, the agency had not disclosed the results of its initial assessment, identified any compromised systems, or confirmed the number of potentially affected taxpayers.
