The Bureau of Internal Revenue (BIR) has acknowledged that certain taxpayer profile information may have been exposed following cybersecurity incidents reported on Nov. 6 and 7, although it maintained that its internal databases and tax filing and payment records remain intact.
In an advisory issued on Tuesday, Nov. 10, the tax agency said its initial investigation found no indication that taxpayer information had been modified or lost.
“The BIR assures the public that the integrity of all internal database infrastructure and system remain intact. Initial findings indicate that no taxpayer information were modified or lost, and no records on filing and payment were compromised,” the agency said.
However, the BIR acknowledged the possibility that some taxpayer information had been accessed without authorization.
“The initial findings further indicate that certain taxpayer profile information may have been exposed,” it said.
The disclosure comes amid allegations that a threat actor operating under the name Happy Go Lucky PH had obtained records involving more than 10 million individual taxpayers, along with corporate and business information.
The alleged breach, reported earlier by cybersecurity monitoring group Deep Web Konek, raised concerns over the security of taxpayer registration information and other data maintained by the agency.
The BIR advisory did not confirm the alleged number of affected records or specify what taxpayer profile information may have been exposed.
The agency said it immediately took steps to preserve evidence, prevent further exposure, and determine the scope of the incidents.
It is now conducting a forensic investigation with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology’s National Computer Emergency Response Team (DICT-NCERT) to establish the source and extent of any unauthorized access.
The National Privacy Commission (NPC) has also been notified of the incidents in accordance with existing data protection regulations.
The BIR said it is strengthening access controls and testing remedial measures to address potential system vulnerabilities.
The agency is also conducting a privacy impact assessment to evaluate possible risks to taxpayers whose information may have been exposed.
While the investigation continues, the BIR advised taxpayers to update their passwords, enable multi-factor authentication where available, and regularly monitor their accounts for unauthorized activity.
It also warned taxpayers to remain alert to phishing attempts and other fraudulent communications that could exploit concerns surrounding the incidents.
The BIR urged the public to conduct tax-related transactions only through its official channels and platforms.
The agency has yet to disclose the specific systems affected, the categories of taxpayer information potentially exposed, or the number of individuals whose records may have been compromised.
