Some taxpayer profile information was potentially exposed, but initial findings showed no compromise of filing or payment records, the Bureau of Internal Revenue (BIR) said Tuesday, Nov. 10.
In an advisory, the bureau said it was responding to cybersecurity incidents reported on Nov. 6 and 7. It said it immediately acted to prevent further exposure and to assess the scope of its affected records.
“The BIR assures the public that the integrity of all internal database infrastructure and system remain intact. Initial findings indicate that no taxpayer information [was] modified or lost, and no records on filing and payment were compromised,” it said.
“The initial findings further indicate that certain taxpayer profile information may have been exposed.”
The advisory came days after reports of a breach containing records of over 10 million taxpayers circulated online. Cybersecurity advocacy group Deep Web Konek attributed the files to threat actor Happy Go Lucky PH and claimed that such data covered government-issued IDs, selfies, taxpayer information, articles of incorporation and corporate documentation.
BIR gave assurance that it is strengthening access controls and testing all remediation measures to protect taxpayer information, which encompasses one’s personal details, including his or her tax identification number.
According to the agency, a forensic investigation to verify the source and extent of possible unauthorized access is ongoing in coordination with the Cybercrime Investigation and Coordinating Center and the Department of Information and Communications Technology – National Computer Emergency Response Team.
Taxpayers are, in the meantime, advised to secure their accounts by updating their passwords and enabling multi-factor authentication.
The bureau also cautioned the public against phishing and suspicious alerts, urging individuals to exclusively conduct transactions through its official channels and platforms.
Aside from BIR, the National Privacy Commission (NPC) confirmed that it has received personal data breach notifications from several government agencies as of Nov. 10.
Among these are the Presidential Commission on Good Government, Department of Information and Communications Technology; and Philippine Amusement and Gaming Corporation.Also included are the Department of Justice through its Office for Alternative Dispute Resolution; the Department of Labor and Employment through its Bureau of Local Employment; the Securities and Exchange Commission, Philippine Coast Guard, Department of Trade and Industry; and Department of Science and Technology – Philippine Institute of Volcanology and Seismology.
In a press release, the commission ordered government agencies to take timely measures in addressing security incidents and mitigating potential harm to affected individuals.
“The NPC further underscores that government agencies, as personal information controllers, remain accountable for the protection of personal data under their control or custody, even when the processing of such data is outsourced or subcontracted to third-party service providers,” it added.
