Philippines SEC confirms data breach as BIR investigates 340K record leak claims

The Philippines is facing concerns over two alleged government data leaks involving the Securities and Exchange Commission (SEC) and the Bureau of Internal Revenue (BIR).

As of the latest update, the SEC has confirmed a data security incident and reported it to the National Privacy Commission (NPC).

However, neither agency has verified the amount of information allegedly stolen or whether the records advertised online were genuine.

All about the Philippine SEC breach

In a press release dated the 9th of November, the SEC detected the security incident that happened on the 6th of November and concluded that the personal information linked to individual accounts may have been exposed.

This includes names, usernames, contact details, dates of birth, residential addresses, and taxpayer identification numbers. However, the agency further clarified that its company records, internal databases, and passwords remained unaffected. 

The Commission further added, 

Additional technical safeguards and monitoring rules across the Commission’s digital infrastructure have likewise been implemented to prevent potential vulnerabilities and recurrence.

For now, the SEC added technical safeguards and monitoring rules to prevent recurrence. Meanwhile, the public is advised to follow six precautionary steps to stay vigilant this time. This includes,

BIR joins the crackdown 

At the same time, the Bureau of Internal Revenue (BIR) is separately investigating claims that approximately 340,000 lines of taxpayer information were being offered for sale online. The SEC faced a similar allegation involving 487,000 lines of information.

However, these figures represent advertised records, not confirmed victims. Since both claims originated from the same account, neither independently validates the other.

This coincided with the Brazilian crypto exchange Mercado Bitcoin suspending deposits and withdrawals on the 2nd of November after detecting a security incident in one of its systems. This further followed a series of crypto security concerns, including Binance’s reported $6.3 billion exploit.

Final Summary

• The SEC concluded that the personal information linked to individual accounts may have been exposed.
• BIR is separately investigating claims that approximately 340,000 lines of taxpayer information were being offered for sale online.