- The Bureau of Internal Revenue (BIR) is investigating reports that its systems may have been hacked after files allegedly linked to the agency surfaced on online hacker forums, raising concerns over the security of government databases.
- Cybersecurity group Deep Web Konek reported that records involving more than 10 million taxpayers had appeared on hacker forums. The files were allegedly linked to threat actor Happy Go Lucky PH, although the claims and the authenticity of the materials have yet to be independently verified.
- In an advisory, the BIR said it was aware of reports circulating online about an alleged leak involving data claimed to be associated with the agency. It is treating the allegations with urgency and has begun investigating the incident.
The Bureau of Internal Revenue (BIR) is investigating reports that its systems may have been hacked after files allegedly linked to the agency surfaced on online hacker forums, raising concerns over the security of government databases.
Cybersecurity group Deep Web Konek reported that records involving more than 10 million taxpayers had appeared on hacker forums. The files were allegedly linked to threat actor Happy Go Lucky PH, although the claims and the authenticity of the materials have yet to be independently verified.
In an advisory, the BIR said it was aware of reports circulating online about an alleged leak involving data claimed to be associated with the agency. It is treating the allegations with urgency and has begun investigating the incident.
BIR taps DICT, PNP cybercrime unit to investigate
The bureau is coordinating with the Department of Information and Communications Technology (DICT), the National Computer Emergency Response Team (NCERT), the Cybercrime Investigation and Coordinating Center (CICC), and the Philippine National Police Anti-Cybercrime Group.
The BIR has also said it is strengthening its security measures while the investigation is ongoing. However, it has yet to establish whether its systems were breached or determine the nature and extent of the information involved.
The National Privacy Commission (NPC) also said it was monitoring reports of alleged data leaks involving several government agencies. As of November 6, it had not received personal data breach notifications from the agencies concerned.
The commission stressed that reports of alleged data leaks do not automatically establish that a breach occurred. It will coordinate with the agencies involved to verify the incidents and determine whether personal information was compromised.
Report comes amid renewed scrutiny of government data security
The latest allegations come after the BIR suspended the mandatory online display of its Registration Seal Badge following privacy concerns. The measure had raised questions about how much business and taxpayer information could be accessed through the bureau's digital services.
The reported incident also adds to concerns over the security of government platforms that collect and store sensitive personal information. These include the national identification system, online government registration services, and proposed age-verification requirements for social media users.
As more public services move online, government agencies must ensure that their digital systems can protect the information entrusted to them. The BIR investigation will be important in determining whether the reported incident involved an actual breach and what security gaps, if any, need to be addressed.
The bureau said it would provide further updates once verified details become available.