BIR Hacked Claim Puts the Leak at 10 Million Taxpayers; the Bureau Says It Is Still Assessing

Posts saying the Philippines' Bureau of Internal Revenue (BIR) was hacked now put the leak at records of more than 10 million taxpayers, a figure the monitoring group Deep Web Konek attributes to a threat actor called Happy Go Lucky PH. In a statement on 9 November the BIR said it had put "immediate response measures" in place to assess the situation, and it still hasn't confirmed that its systems were breached.

The bureau opened its probe with the ICT department, the Cybercrime Investigation and Coordinating Center (CICC) and the police cybercrime unit on 7 November.

Two different claims

Unbox and Kaskasan Buddies both credit the 10 million figure to a Deep Web Konek Facebook post and say the material may contain taxpayer records and corporate registration details; Kaskasan Buddies adds that the files' authenticity has not been verified. Neither outlet names a forum or describes a sample.

An earlier claim was smaller. A thread posted on 5 November by a user called "sinigangmixwithgabi" was titled "Philippines Bureau of Internal Revenue Data 340K Lines", with no list of fields. A count of lines isn't a count of taxpayers.

Happy Go Lucky PH has called an earlier intrusion at the Interior department "an act of hacktivism rather than cybercrime for profit".

What the BIR said on 9 November

The bureau's 9 November statement promised "mga karagdagang update at abiso" (further updates and advisories) as information comes in. It gave no record count and named no data type.

The National Privacy Commission said on 6 November it had "yet to receive personal data breach notifications" from the agencies named in that week's leak posts. The SEC, named alongside the BIR, has since told portal users their tax ID numbers were exposed.

What taxpayers are told to do

The BIR asks taxpayers to handle tax matters only through its official websites, platforms and authorised channels.