The Bureau of Internal Revenue (BIR) is investigating reports of a data leak tied to the agency. In an advisory dated November 6th, the BIR says it is aware of reports circulating online about an alleged leak of data “claimed to be associated with the agency,” and that it is treating them “with utmost urgency and priority.”
The BIR is working with the Department of Information and Communications Technology (DICT), the National Computer Emergency Response Team (NCERT), the Cybercrime Investigation and Coordinating Center (CICC) and the Philippine National Police (PNP) Anti-Cybercrime Group. The bureau says it is coordinating with them to investigate further and strengthen its security measures.
The advisory doesn’t say what kind of data the reports involve, how many taxpayers could be affected or whether any BIR system was actually breached. The bureau still calls the leak alleged, and promises updates “as soon as verified details become available.”
The National Privacy Commission (NPC) says it is aware of reports of alleged leaks at several government agencies on November 5th; its statement doesn’t name them. As of November 6th, the NPC had received no breach notifications from the agencies concerned, it says, and reports of a leak don’t by themselves prove that one happened.
The NPC says it will contact the agencies named in those reports to check what happened and whether personal data was compromised. If the BIR confirms a breach that requires notification, NPC rules give it 72 hours from knowing, or reasonably believing, that it happened to tell the commission and the taxpayers affected.
