The Securities and Exchange Commission of the Philippines has confirmed a data security incident affecting its systems and reported it to the National Privacy Commission, while the Bureau of Internal Revenue separately investigates claims that taxpayer records were offered for sale online. Neither agency has verified how much information was allegedly taken or whether the records advertised online were genuine.
What the SEC disclosed
In a press release dated November 9, the SEC said it detected the security incident on November 6 and concluded that personal information linked to individual accounts may have been exposed.
The potentially exposed data includes names, usernames, contact details, dates of birth, residential addresses and taxpayer identification numbers, according to the commission.
The SEC said its company records, internal databases and passwords were not affected.
Safeguards and guidance
The commission said it has added technical safeguards and monitoring rules across its digital infrastructure to address potential vulnerabilities and prevent a recurrence. It also advised the public to follow six precautionary steps to stay vigilant.
BIR investigation into advertised records
The BIR is looking into claims that approximately 340,000 lines of taxpayer information were being offered for sale online. The SEC faced a similar allegation involving 487,000 lines of information.
Those figures refer to records advertised for sale, not to confirmed victims.
Claims remain unverified
Because both claims originated from the same account, neither independently validates the other, according to the report. The status of the advertised records, including whether they correspond to genuine data, has not been established by either agency.
