BIR Data Leak: Philippine Tax Bureau Opens Probe With DICT, CICC and Police Cybercrime Unit
BIR data leak: the Philippines' Bureau of Internal Revenue is investigating claims that its data was leaked, with DICT, CICC and police, but hasn't said what may have been taken.
The Philippines' Bureau of Internal Revenue (BIR) has opened an investigation into "an alleged leak involving data claimed to be associated with the agency", GMA News reported on 7 November. The BIR was among the 11 government agencies that forum posters said they had breached earlier this week. It hasn't confirmed a breach, and it hasn't said what data might be involved or how many taxpayers could be affected.
Who is investigating
The bureau's advisory says it is working with the Department of Information and Communications Technology and two of its attached agencies, the National Computer Emergency Response Team and the Cybercrime Investigation and Coordinating Center. The PNP Anti-Cybercrime Group is also on the case, Bombo Radyo reports, quoting the advisory: "Kasama rin sa naturang imbestigasyon ang PNP Anti-Cybercrime Group" (the PNP Anti-Cybercrime Group is also part of the investigation). The BIR says the claims are being handled "with utmost urgency and priority" and that it has stepped up security measures. It promised a further update once the details are verified.
The claim behind it
The bureau's advisory doesn't name a claimant. On 6 November Radar, citing the monitoring group Deep Web Konek, reported that a forum user calling themselves "sinigangmixwithgabi" had posted what they presented as files from the SEC and the BIR.
Nobody has verified that the files came from either agency.
The National Privacy Commission said the same day that it had not received personal-data breach notifications from the agencies concerned. If a notifiable breach is found, agencies have "within 72 hours" to tell the commission and the people affected.
September's defacement
Hackers defaced the BIR's website on 8 September; at the time the bureau said taxpayer information and core systems weren't affected. The BIR has not established a connection between that incident and this week's allegations, and it has given taxpayers no advice so far.
More news
Who Gives A Crap Data Breach: Customer Names and Addresses Exposed Through a Marketing Vendor
Who Gives A Crap data breach: the Australian toilet paper brand says a US marketing software provider exposed customers' names, contact details and spend. No card data or passwords.
Malaysia Cyber Attack: Security Council Confirms Disruptions at Several Financial Institutions, Names None
Malaysia cyber attack: the National Security Council says NACSA is tracking incidents and system disruptions at several financial institutions, names none, and keeps the threat level at Moderate.
Bank Rakyat Cyberattack: Minister Says Hackers Defaced a Third-Party Site but Took No Data
Bank Rakyat cyberattack: Malaysia's communications minister says a third-party-managed bank site was hacked and defaced, with no data stolen. The bank blames a supplier's technical problem.