The Securities and Exchange Commission (SEC) and Bureau of Internal Revenue (BIR) are investigating separate reports of possible data leaks involving information supposedly linked to their offices, raising fresh concerns over the security of sensitive corporate and taxpayer records.
Neither agency has confirmed a breach or established whether unauthorized access occurred, with both carefully describing the information circulating online as data “claimed to be associated” with their respective offices.
The SEC said it learned of the reports on November 6 and had launched a thorough investigation, alongside tighter security measures and increased monitoring of its systems.
“These claims are being treated with utmost urgency and importance,” the corporate regulator said in a November 7 advisory.
The BIR, meanwhile, said it was coordinating with the Department of Information and Communications Technology, the National Computer Emergency Response Team, the Cybercrime Investigation and Coordinating Center, and the Philippine National Police Anti-Cybercrime Group to investigate the allegations and reinforce its security defenses.
“We remain dedicated to ensuring the privacy, confidentiality, and security of all taxpayer records entrusted to the Bureau,” the BIR said in its November 6 advisory.
Neither agency disclosed the nature or volume of the records allegedly exposed, the systems potentially affected, or whether investigators had found evidence of unauthorized access.
It also remains unclear whether the two reported incidents are connected.
The allegations put the spotlight on the security of government-held data covering businesses and taxpayers. The SEC maintains corporate registration and disclosure records, while the BIR handles sensitive taxpayer information, making the scope and credibility of the reported exposure particularly consequential.
The investigations have yet to establish whether the circulating information came from compromised government systems or whether an actual breach took place.
The BIR said it would issue further updates once verified information becomes available.
