Concurrently, the Securities and Exchange Commission (SEC) confirmed a separate cybersecurity incident detected on its digital platforms on November 6. In a statement released Monday, the SEC said preliminary forensic reviews indicated that corporate records remained intact, internal databases were not altered, and no passwords were leaked. However, the regulator acknowledged that individual profile information may have been exposed. The SEC formally notified the National Privacy Commission (NPC) of the breach on November 9 and applied system-wide access controls, credential updates, and log analyses to isolate the compromised vectors.
The BIR has not disclosed the extent of the potential leak or the specific types of information involved, noting that allegations circulating online do not automatically establish a confirmed breach. The agency advised the public to conduct transactions exclusively through official channels and remain vigilant. This dual investigation occurs amid heightened concern over state cybersecurity in the Philippines, following earlier incidents including a 2023 ransomware attack on the Philippine Health Insurance Corp. and a brief website defacement of the BIR in September, which the agency previously stated did not affect taxpayer data.
The NPC, the country’s privacy regulator, stated on November 6 that it had not received personal-data breach notifications from the agencies concerned as of that date. The commission emphasized that it would coordinate with the agencies to establish whether personal information had been compromised. Both the BIR and SEC have urged account holders to enable multifactor authentication, update passwords, and report any suspicious inquiries to official authorities.
