Some taxpayer details may have been exposed in cybersecurity incidents reported on Nov. 6 and 7, 2026, the Bureau of Internal Revenue (BIR) said.
BIR has yet to say what details may have been exposed or how many taxpayers may be affected. It is investigating how someone may have gained access to the information and which records were involved.
“Initial findings indicate that no taxpayer information was modified or lost, and no records on filing and payment were compromised,” the BIR said in a statement.
The agency said its internal databases and systems remain intact. It took steps to keep evidence, prevent further exposure, and check which records may have been affected.
The BIR is working with the Cybercrime Investigation and Coordinating Center (CICC) and the Department of Information and Communications Technology’s National Computer Emergency Response Team (DICT-NCERT) on the investigation.
It has also notified the National Privacy Commission (NPC).
The agency said it is tightening rules on who can access its systems and testing fixes for security weaknesses. It is also checking how the incidents may affect taxpayers’ privacy.
The BIR advised taxpayers to change their passwords and turn on multifactor authentication, which adds another step to verify their identity when signing in. It also urged them to check their accounts for unfamiliar transactions or unusual alerts and watch out for fake messages.