Sep 8, 2026
MANILA, Philippines — The official website of the Bureau of Internal Revenue (BIR) was briefly defaced in a cyberattack on the evening of September 8, 2026, marking the latest in a series of breaches targeting Philippine government platforms.
The attack, claimed by a group calling itself "3Musketeerz," replaced the BIR homepage with the message "3Musketeerz was here," a "troll face" meme, and text referencing the country's ongoing flood-control issues. The defacement was short-lived, with BIR and Department of Information and Communications Technology (DICT) technical teams restoring the site shortly after.
Taxpayer Data Unaffected, BIR Assures
In a statement, the BIR said its initial assessment found that taxpayer information and core BIR systems were not affected by the incident. As a precaution, the agency is conducting additional security checks and temporarily took down affected pages for restoration and security strengthening.
The agency's chatbot, REVIE, may be temporarily unavailable while technical work continues, the BIR said, adding that its technical team is monitoring the situation and working to restore the service as soon as possible.
Coordinated Investigation Underway
The BIR said it is coordinating with the DICT's National Computer Emergency Response Team (NCERT), the Cybercrime Investigation and Coordinating Center (CICC), and the Philippine National Police Anti-Cybercrime Group to investigate the incident further and strengthen security measures.
The attack on the BIR came amid a broader wave of cyber incidents targeting Philippine government websites. On the same day, the Department of Migrant Workers (DMW) website experienced unauthorized access, and a Department of Labor and Employment (DOLE) web host was defaced.
Broader Concerns Over Government Cybersecurity
The latest incidents have reignited concerns about the state of cybersecurity in Philippine government agencies. Advocacy group BetterGov.ph raised alarm over what it described as a reactive approach to cybersecurity, where weaknesses are addressed largely after an attack has already occurred.
"What's needed: regular security checkups, faster fixes, and clear public updates. Not a one-time patch," the group said in a Facebook post. BetterGov noted that this was not the first time government websites had been attacked and cautioned that assurances that data is safe do not address the broader cybersecurity problem.
In response to the recent breaches, the DICT and CICC directed government agencies to conduct cybersecurity assessments and strengthen their defenses, including identifying critical vulnerabilities, applying patches, and improving incident response measures.
What's Next
The BIR has pledged to prevent similar breaches and is working to restore full functionality to its website and chatbot services. The agency continues to coordinate with national cybersecurity authorities to trace those behind the attack and determine how the breach occurred.
For taxpayers, the BIR maintains that no sensitive data was compromised. However, the incident serves as a reminder of the growing cyber threats facing government institutions and the need for continuous, proactive security measures rather than reactive fixes.
Sources: