BIR Data Breach 2026 — Some Taxpayer Profile Data May Have Been Exposed, Filing and Payment Records Safe
BIR DATA BREACH 2026 – The Bureau of Internal Revenue (BIR) has confirmed that certain taxpayer profile information may have been exposed after cybersecurity incidents hit the agency last week, but it said tax filing and payment records were not compromised.
In an official advisory dated November 10, 2026, 5:00 PM, the BIR said it is “actively responding” to incidents reported on November 6 and 7, 2026. The bureau said it immediately moved to preserve evidence, stop further exposure, and determine the scope of the records affected.
What the BIR Said
According to the advisory, the integrity of the BIR’s internal database infrastructure and systems remains intact. Its initial findings show that:
- No taxpayer information was modified or lost;
- No records on tax filing and payment were compromised; but
- Certain taxpayer profile information may have been exposed.
The bureau did not say which profile details were involved or how many taxpayers may be affected. A forensic investigation is now being carried out together with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology – National Computer Emergency Response Team (DICT-NCERT) to verify the source and extent of any unauthorized access.
The BIR added that it has notified the National Privacy Commission (NPC), and that it is strengthening access controls and testing all remediation measures while it completes a privacy impact assessment.
How Big Is the Alleged Leak?
The advisory came days after claims circulated online about a leak said to involve the records of more than 10 million taxpayers. As reported by Philstar Tech and Newsbytes.PH, the cybersecurity group Deep Web Konek linked the files to a threat actor calling itself “Happy Go Lucky PH.” The BIR has not confirmed that figure.
The BIR is not the only agency involved. The NPC said it has received personal data breach notifications from 10 government agencies, including the BIR, the DICT and the Securities and Exchange Commission (SEC), Manila Standard reported. The commission’s Compliance and Monitoring Division is assessing each report before the commission en banc decides on any regulatory action.
Under NPC Circular No. 16-03, government agencies and other personal information controllers must notify the NPC and the affected individuals within 72 hours once they know, or reasonably believe, that a breach requiring mandatory notification has happened.
What Taxpayers Should Do Now
While the investigation is ongoing, the BIR is asking taxpayers to take these basic security steps:
- Change your passwords – Update your login credentials and passwords across your accounts, especially if you reuse the same password on different sites.
- Turn on multi-factor authentication (MFA) – Enable it wherever it is available.
- Monitor your accounts – Regularly check your personal accounts for unauthorized transactions or unusual alerts.
- Watch out for phishing – Stay alert to fake emails, text messages and calls that may use the incident to trick you.
- Use only official BIR channels – Do your tax transactions only through the BIR’s official website, www.bir.gov.ph, and its official platforms.
The NPC also reminded the public not to click unfamiliar links, download suspicious attachments, or give personal information to unverified parties, as scammers may take advantage of worries over the reported breaches.
Where To Send Your Questions
Taxpayers with questions about the incident may email the BIR’s Data Protection Officer at [email protected]. The BIR National Office trunklines are 8981-7000 and 8929-7676.
Further updates are expected once the forensic investigation and the NPC’s assessment are completed.
Have you already updated the passwords of your online accounts? You may also want to read about the BIR One-Time Tax Abatement 2026 for micro taxpayers.
