11-12-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: Two government agencies in the Philippines are dealing with reported data breaches int he same week, just as a new report finds Filipinos lost about $2.18 billion to online scams this year.
Key Takeaways:
- The Bureau of Internal Revenue (BIR) is investigating a claim that over 10 million taxpayer records were hacked.
- The SEC confirmed on November 10, 2026, that user data on its platforms may have been leaked.
- The SEC said no passwords were compromised but has not disclosed how many users were affected.
- Filipinos lost about PHP 121.8 billion ($2.1 billion) to digital scams in 2026, according to GASA.
- Scammers’ use of digital wallets to move stolen funds rose from 34% to 73% in one year.
Data breaches are hitting organizations worldwide, and the Philippines is among the latest targets in Asia. Recently, the Bureau of Internal Revenue (BIR) was reportedly hacked, followed by the country’s Securities and Exchange Commission (SEC) confirming a data breach on its digital platform. Meanwhile, a new report found that Filipinos lost PHP 121.8 billion ($2.1b billion)to digital scams this year.
Philippines’ tax agency investigates alleged data breach
According to a November 9 report by the Philippine News Agency, the BIR—the primary agency for assessing and collecting national internal revenue taxes—is reportedly coordinating with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology-National Computer Emergency Response Team (DICT-NCERT) to investigate claims of a cybersecurity breach involving taxpayer records.
The agency issued an advisory following allegations that a hacker gained unauthorized access to over 10 million individual taxpayer records, along with the victims’ corporate and business information.
“The Bureau of Internal Revenue (BIR) informs taxpayers that claims of cybersecurity breaches are currently being addressed in coordination with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology-National Computer Emergency Response Team (DICT-NCERT),” the agency said.
The advisory followed reports from cybersecurity monitoring group Deep Web Konek about a threat actor named “Happy Go Lucky PH.” Deep Web Konek alleged that the threat actor obtained a large amount of data from the BIR’s taxpayer registration systems, reportedly including taxpayers’ registration details, business records, and other personal information.
As of this writing, the agency has admitted that some taxpayer information was exposed following the reports; however, it maintained that its internal databases and tax filing, as well as its payment records, haven’t been compromised.
“Immediate response measures have been implemented to assess the situation and protect the security and integrity of its systems and taxpayer data,” the BIR said. “The BIR remains committed to strengthen its cybersecurity posture.”
The allegations have put the BIR’s Correspondence Verification Portal and QR-based Registration Seal Badge back in the spotlight. Both faced criticism for exposing taxpayer verification details to the public, and many now question whether the systems and databases behind them are secure enough.
On October 26, the agency paused the required online posting of the badge under Revenue Memorandum Circular No. 113-2026, although investigators have not tied the alleged breach to either system.
A day after the BIR advisory, the SEC confirmed unauthorized access to its digital platforms.
Philippines SEC confirms breach, number of affected users undisclosed
On November 10, the SEC—the agency charged with registering and supervising corporations and securities in the Philippines—confirmed a data breach involving its digital platforms.
In an advisory, the SEC said user details from its digital platforms “may have been leaked potentially through malware infection or unauthorized access by a third-party threat actor of your laptop, desktop, mobile phone or any other device you used to access our digital platforms.”
The agency has yet to explain how the incident happened, but sent notices to affected users following Deep Web Konek’s report of a possible breach of SEC-related user accounts.
“The categories of potential information that may have been exposed are strictly limited to: full name, username, email address, mobile number, date of birth, gender, address and TIN (tax identification number) of your individual account,” the SEC advisory said.
“The SEC is conducting a thorough investigation of the matter and enforcing enhanced security measures together with heightened monitoring of its systems,” it added.
The agency has not released the total number of affected users but said no passwords were compromised and no data was modified or altered.
The SEC reassured that its technical response teams have initiated containment and preventive protocols, including notifying the National Privacy Commission (NPC).
“Comprehensive security scans and log analyses were also initiated across all digital infrastructure to determine if any internal system showed signs of unauthorized access,” it said. “We further reinforced access controls, updated authentication credentials and verified data integrity to ensure no data modification occurred and corporate data assets remain secure.”
The SEC advised affected users to take security measures, such as changing their passwords and being cautious of unexpected emails, calls, or messages asking for personal or account information. “The SEC will never ask for your passwords or security PINs,” it warned.
The timing of the BIR and SEC breaches could hardly be worse, as a new report shows just how costly these cyber threats have become for ordinary Filipinos.
Filipinos lost $2.18 billion to digital scams: report
According to GASA’s 2026 State of Scams Philippines Report, 84% of 1,160 Filipino adult respondents encountered an online scam in 2026, up from 77% in 2025. These scams cost Filipinos an estimated PHP 121.8 billion (US $2.18 billion) in 2026, the report said.
The report, produced with Mastercard (NASDAQ: MA) and Gogolook, found that while 58% of Filipinos say they can confidently spot scams, 60% of those exposed still engaged with a scammer. Meanwhile, 15% lost money or personal data that led to financial loss, but only 4% reported the scam to authorities.
The findings also showed scammers are increasingly turning to digital wallets to move stolen money. The reported use of digital wallets to transfer illicit funds jumped from 34% to 73% in just one year.
GASA closed its report with some recommendations to curb scams, which include:
- Establishing a National Anti-Scam Hub (NASH)
- Implementing a Unified National Reporting and Case Management System
- Expanding shared intelligence across the ecosystem
- Strengthening real-time intervention and fund recovery capabilities
- Enhancing financial tracing and criminal network disruption
- Deepening public-private collaboration
- Strengthening platform accountability and preventive controls
- Improving consumer verification and scam prevention tools
- Creating a national scam awareness and education framework
- Strengthening victim support and recovery mechanisms
FAQs:
Was the BIR hacked?
The BIR is investigating claims that over 10 million taxpayer records were stolen. The agency has not yet verified the data or the number of people affected.
Who hacked the BIR?
Deep Web Konek linked the alleged breach to a threat actor called “Happy Go Lucky PH.”
What data was leaked in the SEC breach?
Names, usernames, emails, mobile numbers, birth dates, gender, addresses, and TINs may have been exposed. The SEC said no passwords were compromised.
How many users were affected by the SEC breach?
The SEC has not released the number of affected users. It has notified affected users and the National Privacy Commission.
What should I do if my SEC account was affected?
Change your password and watch for suspicious emails, calls, or messages. The SEC said it will never ask for your password or PIN.
How much did Filipinos lose to scams in 2026?
Filipinos lost about PHP 121.8 billion ($2.18 billion) to digital scams in 2026, according to GASA’s State of Scams Philippines Report.
How do scammers move stolen money in the Philippines?
Mostly through digital wallets. Their reported use for moving illicit funds jumped from 34% to 73% in one year.
What does GASA recommend to stop digital scams?
GASA recommends a National Anti-Scam Hub, a unified reporting system, stronger fund recovery, platform accountability, public awareness programs, and better victim support.
Watch | DigiCon 2026: Interoperability Starts With People
