Philippines' BIR admits taxpayer profile data may have leaked in cyber breach
The Bureau of Internal Revenue says taxpayer profile information may have been exposed in a cyber breach, though it insists no records on filing or payment were touched. The admission came in a Nov. 10 advisory, days after breach reports surfaced and the National Privacy Commission logged notifications from 10 government agencies.
- Original source: business.inquirer.net.
- Not verified by major outlets. This story may be false.
- No second outlet has reported it yet. Treat it as a single-source claim.
- The source shows no publish time. The time above is when we found it.
The Bureau of Internal Revenue has confirmed what it spent days dancing around: taxpayer profile information may have leaked. In an advisory dated Nov. 10, the agency said its internal database infrastructure and systems remain intact, initial findings show no taxpayer information was modified or lost, and no filing or payment records were compromised. It did not say what specific data may have been exposed.
The BIR said it moved to preserve evidence, stop further exposure and pin down the scope of affected records after breach reports surfaced on Nov. 6 and Nov. 7. It is tightening access controls and testing remediation measures to close the system vulnerability. The agency also told taxpayers to change their credentials and passwords, switch on multifactor authentication, watch their account activity and stay sharp against phishing and other fraudulent messages.
The breach claims went public on Nov. 6, when the BIR said it was coordinating with the Cybercrime Investigation and Coordinating Center, the DICT's National Computer Emergency Response Team and the Philippine National Police Anti-Cybercrime Group. Four days later, the National Privacy Commission said it had received breach notifications from 10 government agencies, the BIR among them. The others included the DICT, Department of Justice, Presidential Commission on Good Government, Department of Labor and Employment, Philippine Amusement and Gaming Corp., Securities and Exchange Commission, Philippine Coast Guard, Department of Trade and Industry and the DOST's Philippine Institute of Volcanology and Seismology.
Philippine cybersecurity advocacy group Deep Web Konek pointed the finger at two alleged hacker handles: 'Happy Go Lucky PH' and 'sinigangmixwithgabi.' According to the group, the first accessed 10 million personal information records and 500,000 corporate records, while the second got into about 340,000 text data lines. Government officials have not officially confirmed those claims.
TopicsBureau of Internal Revenue · National Privacy Commission · Department of Information and Communications Technology · Deep Web Konek · Philippine National Police Anti-Cybercrime Group · Department of Justice · Securities and Exchange Commission · Philippine Amusement and Gaming Corp.
Source: business.inquirer.net
Written by Paparazzi with AI. Not financial advice.