Bureau of Internal Revenue (Philippines) data breach

Bureau of Internal Revenue (Philippines) announced a data breach on Nov 10, 2026. The number of people affected has not been disclosed. It was caused by a cyberattack. No settlement or compensation has been announced.

What happened

The Philippines' Bureau of Internal Revenue (BIR) said in an advisory on November 10, 2026 that initial findings indicate certain taxpayer profile information may have been exposed in cybersecurity incidents reported on November 6 and 7. It said no taxpayer information was modified or lost and no filing or payment records were compromised, and that it notified the National Privacy Commission and is running a forensic investigation with the CICC and DICT-NCERT. BIR has not said what data or how many taxpayers are involved; a hacker's claim of more than 10 million taxpayer records has not been confirmed.

What should I do?

1. Update your BIR online account passwords and any accounts that share the same password, and turn on multi-factor authentication where available.
2. Transact only through BIR's official channels and platforms, and ignore tax notices or payment requests sent by text or unofficial email.
3. Watch for phishing that uses your TIN, name or business details, and send questions to bir_dpo@bir.gov.ph.
4. Monitor your bank and e-wallet accounts for unauthorized transactions.

Check the other services you use →