The Philippines’ Bureau of Internal Revenue is investigating claims that more than 10 million taxpayer records were accessed. Separately, the Securities and Exchange Commission has confirmed unauthorized access to its digital platforms. Neither incident has been linked to the online scams that the Global Anti-Scam Alliance estimates cost Filipinos ₱121.8 billion in 2026.
- The BIR says some taxpayer information may have been exposed, but tax filing and payment records were not compromised.
- The SEC says account details may have been exposed, but passwords were not compromised.
- GASA’s ₱121.8 billion figure is an estimate, not an audited national tally.
What is known about the BIR incident
A November 9, 2026, report by the Philippine News Agency said the BIR was working with the Cybercrime Investigation and Coordinating Center and the Department of Information and Communications Technology’s National Computer Emergency Response Team to investigate claims of a cybersecurity breach.
The claim was that a hacker accessed more than 10 million individual taxpayer records, along with corporate and business information. The BIR had not verified the number. Cybersecurity monitoring group Deep Web Konek attributed the alleged breach to a threat actor known as “Happy Go Lucky PH, ” but that attribution has not been independently established.
In a later statement, the BIR acknowledged that some taxpayer information may have been exposed. It said tax filing and payment records were not compromised and that it had put response measures in place to assess the situation and protect taxpayer data.
The scope of the incident and how it happened remain unclear. On October 26, the BIR paused the required online posting of its QR-based Registration Seal Badge under Revenue Memorandum Circular No. 113-2026. Investigators had not linked the badge or the BIR’s Correspondence Verification Portal to the alleged breach. Earlier concerns about public exposure of taxpayer verification details do not show that either system was involved.
SEC confirms unauthorized access
On November 10, 2026, the SEC confirmed unauthorized access involving its digital platforms. The agency said information that may have been exposed could include a person’s full name, username, email address, mobile number, date of birth, gender, address and tax identification number, or TIN.
A TIN is an identifier used for tax administration. The SEC did not say how many users may have been affected. It said passwords were not compromised and no data had been modified or altered.
The SEC said it had notified the National Privacy Commission, started security scans and log analysis, reinforced access controls, updated authentication credentials and checked data integrity. It advised potentially affected users to change their passwords as a precaution and watch for suspicious emails, calls or messages asking for personal or account information.
The agency also said it will never ask for passwords or security PINs. If someone asks for them while claiming to represent the SEC, end the contact and verify the request through an official channel.
Scam exposure is widespread, but confidence is no shield
The Global Anti-Scam Alliance’s 2026 State of Scams Philippines Report, produced with Mastercard and Gogolook, found that 84% of surveyed Filipino adults encountered an online scam in 2026, up from 77% in 2025. GASA estimated annual losses from scams at ₱121.8 billion.
The report found a gap between people’s confidence and their behavior. While 58% of respondents said they could confidently spot scams, 60% of those who encountered one still engaged with a scammer. Fifteen percent said they lost money or personal data that led to financial loss.
GASA also found that reported scammer abuse involving digital wallets rose from 34% to 73% in one year. That points to a growing role for digital wallets in scam activity. It does not identify specific providers or explain how funds moved in individual cases.
Scams often arrive through familiar online channels. GASA reported that 39% of respondents were approached through instant messaging apps and 36% through social media posts. It said 88% of scam attempts took place on platforms with a direct-message function.
The damage can go beyond financial loss. GASA reported that 82% of scam victims said the experience harmed their mental wellbeing, while 22% said they could not afford basic essentials as a result. Twenty percent of parents surveyed said their child had experienced a scam.
What the figures do and do not show
GASA describes ₱121.8 billion as an estimate of annual losses, not an audited accounting of every scam loss in the country. The report details available here do not explain the assumptions behind the national estimate. The figure gives an idea of the reported scale of the problem, not a precise ledger.
Dollar equivalents reported alongside the peso figure vary, including $2.1 billion, $2.18 billion and $2.2 billion. The exchange-rate basis and conversion date are unclear, so the peso estimate is the most reliable figure to cite.
Reporting rates also depend on which respondents are counted. GASA said 4% of all respondents reported a scam to authorities. Among respondents who lost money, the rate was 29%. The first figure should not be mistaken for the reporting rate among people who suffered financial losses.
GASA recommends creating a national coordinating body and a shared case-management function to close gaps between agencies and improve response. Public education can help people recognize warning signs, but it cannot replace systems that respond when accounts, platforms or payment channels are abused.
Key questions and answers
-
Was the alleged BIR breach of more than 10 million records confirmed?
No. The BIR was investigating the claim and acknowledged that some taxpayer information may have been exposed, but the alleged number has not been verified. The agency said tax filing and payment records were not compromised.
-
What information may have been exposed at the SEC?
The SEC listed names, usernames, email addresses, mobile numbers, dates of birth, gender, addresses and TINs. It said passwords were not compromised but did not say how many users may be affected.
-
How much did scams cost Filipinos in 2026?
GASA estimated annual losses at ₱121.8 billion. The figure is an estimate, and the dollar conversions reported alongside it are inconsistent.
-
Does confidence in spotting scams prevent people from engaging?
Not reliably. Although 58% of respondents said they could confidently spot scams, 60% of those who encountered one still engaged with the scammer.
-
Are the data incidents connected to the scam losses?
No connection has been established. The available information does not show that either agency incident caused or contributed to GASA’s estimated losses.
If you may be affected, follow the relevant agency’s guidance, change your password where advised and never share passwords, PINs or authentication codes in response to an unsolicited request. Agencies also need to clarify what data was accessed, notify people at risk and explain how they will reduce the chance of another incident. Digital services can make public administration and payments more accessible. When they fail, “be careful” is not enough on its own.
