BIR Data Breach: Tax Bureau Says Taxpayer Profile Data May Have Been Exposed

The Philippines' Bureau of Internal Revenue (BIR) said in an advisory on 10 November that "certain taxpayer profile information may have been exposed" in cybersecurity incidents on 6 and 7 November. Until then the bureau had only said it was still assessing a hacker's claim of more than 10 million taxpayer records. It hasn't said which details were taken or how many taxpayers may be affected.

What the bureau says is intact

Its statement, as Back End News quotes it: "no taxpayer information was modified or lost, and no records on filing and payment were compromised". The bureau also says "the integrity of all internal database infrastructure and system remain intact". Happy Go Lucky PH, the group credited with the leak by the monitoring account Deep Web Konek, says it holds records of over 10 million individual taxpayers plus corporate data. The BIR has neither confirmed nor disputed that figure.

The tax bureau is one of 23 institutions named in hacker-forum posts between 5 and 7 November.

Who is investigating

A forensic investigation into the source and extent of the access is running with the Cybercrime Investigation and Coordinating Center (CICC) and the DICT's National Computer Emergency Response Team. The bureau says it has notified the National Privacy Commission, is tightening access to its systems and is testing fixes.

The BIR wasn't on the commission's 10 November list of agencies that had filed breach notifications: PCGG, DICT, PAGCOR, DOJ-OADR, DOLE-BLE, SEC, the Coast Guard, DTI and DOST-PHIVOLCS.

What taxpayers are told to do

The BIR asks taxpayers to update their passwords and enable multi-factor authentication, to check their accounts for unfamiliar transactions, unusual alerts and fake messages, and to deal with the bureau only through its official channels and platforms.