Skip to content
BIR Investigates Alleged Data Breach of 10 Million Taxpayer Records

BIR Investigates Alleged Data Breach of 10 Million Taxpayer Records

First seen 9 Nov 2026, 15:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 9, 2026 at 15:09 UTC
  • •Over 10 million taxpayer records may have been compromised in the alleged breach.
  • •The BIR is coordinating with multiple cybersecurity agencies to investigate the incident.
  • •The authenticity of the claims and the extent of the breach have not been independently verified.

The Bureau of Internal Revenue (BIR) is investigating an alleged data breach involving over 10 million taxpayer records, reportedly accessed by a threat actor known as Happy Go Lucky PH. The BIR is collaborating with the Department of Information and Communications Technology (DICT) and the Cybercrime Investigation and Coordinating Center (CICC) to assess the situation. Allegations surfaced from cybersecurity monitoring group Deep Web Konek, which claims that sensitive information, including taxpayer and corporate records, has been compromised. The BIR has not confirmed the breach or the authenticity of the claims but is treating the situation with urgency. The incident raises concerns about the security of the BIR's systems, particularly its QR-based Registration Seal Badge, and could expose individuals to identity theft and financial fraud. This comes shortly after the BIR suspended the mandatory online display of its registration badge due to previous criticisms regarding data accessibility.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-11-07
Alleged data breach reported
Cybersecurity group Deep Web Konek claims that over 10 million taxpayer records were accessed by Happy Go Lucky PH.
Gmanetwork
2026-11-09
BIR issues advisory
The BIR confirms it is investigating the alleged breach and working with DICT and CICC.
Newsbytes.Ph

More articles in this cluster (3)

Following this threat?

Track Bureau Of Internal Revenue in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 3

Common questions

What information may have been compromised?
The alleged breach could involve taxpayer records, corporate registration details, and business records.
What is the current status of the investigation?
The BIR is actively investigating the claims in coordination with cybersecurity agencies.
How can taxpayers protect themselves?
Taxpayers should monitor their accounts for suspicious activity and consider identity theft protection services.