A public resource tracking cybersecurity incidents affecting Philippine schools. Because student data deserves better protection.
Schools hold some of the most sensitive data imaginable — children's personal information, family details, medical records. Yet most Philippine schools lack the resources and awareness to protect this data. This tracker exists to raise awareness and drive change.
Most schools don't know breaches are happening in Philippine education. Visibility is the first step to action.
By tracking incidents, we identify common attack vectors and vulnerabilities so schools can prioritize defenses.
Every breach listed here includes lessons learned. We want schools to learn from others' mistakes, not their own.
Free tools and educational resources to assess your school's security posture and build a culture of data protection.
On November 12, 2026, the Facebook page 'Liwat' published a post addressed to a state university in Eastern Visayas, saying 'The goal was never access' and asking the university to message the actor privately about an undisclosed vulnerability. The post adds, in Filipino, that the university should not delay 'so I won't have to post the sensitive file.' Screenshots show a logged-in student portal dashboard and the university's journal-publishing site. No records are released or described. The claim is single-source and unverified, and the institution has not issued a public statement.
On or about November 11, 2026, the Facebook page 'QuantumSec Group' published a post addressed to a state university in Northern Luzon and tagging the registrar's office of one of its campuses. The post is framed as a grievance about how engineering students at another campus are treated by some faculty, and ends with two base64-encoded links labelled 'Data' and 'Video', signed 'Kr0vm4k'. The 'Data' link points to a CSV file on a public file-sharing host whose filename names the campus; the 'Video' link points to a video-hosting site. The post states no record count and does not describe the file's contents, and this site has not opened either link. The claim is single-source and unverified, and the institution has not issued a public statement.
On November 9, 2026, the Facebook page 'The High Table' published a post addressed to a private college in CALABARZON, claiming the college's database had been breached. The post claims access to a database of 696 tables, says more than 300,000 records across 14 tables were 'disclosed', and says administrator accounts and user login tokens were 'allegedly exposed'. Four screenshots show terminal queries listing table names covering grades, attendance, enrollment, fees, payments, approvals and documents; no row-level data is visible in the post's preview images. The same page addressed a state university campus in CALABARZON four days earlier. The claim is single-source and unverified, and the institution has not issued a public statement.
On November 8, 2026, the Facebook page 'CrimsonSec Philippines' published findings it attributes to a private technological institute in Metro Manila, alongside a matching post on a dark-web forum. The post claims that an applicant-system API answered requests without any authentication, allowing 17,114 full applicant records to be retrieved in under 30 seconds, including names, personal emails, mobile numbers, Learner Reference Numbers, addresses, dates of birth, religion, and citizenship. It also claims the API allowed unauthenticated file uploads and state-changing actions, including password changes, and that the web application firewall in front of it did not stop the scraping. The post describes the system as a test instance holding real personal data, and links to a downloadable archive presented as the dump. The download link and all personal data are withheld on this site. The institution has not issued a public statement, and this entry is recorded as 'unconfirmed' on the basis of the threat-actor claim.
On or about November 8, 2026, the Facebook page 'Liwat' published a post addressed to a state university in Eastern Visayas, tagging one of its campuses. A screenshot shows the university's public 'About' page with the text 'liwat itun HAHAH' added to the footer, and further screenshots appear to show the site's content-management administrator panel, including an article titled with a greeting from Liwat. The post asks the university to email the actor that evening and says another institution in the region had ignored it. No data was claimed. The claim is single-source and unverified, and the institution has not issued a public statement.
On November 6, 2026, a user under the alias 'pocherowithpetchay' posted on a dark-web forum that the University of St. La Salle (USLS) in Bacolod City had exposed the personal information of more than 11,000 students, including full names, home addresses, contact numbers, birthdates, parents' names and contact numbers, academic records, medical records, class schedules, and tuition balances. The post reuses, nearly word for word, the Million Mask March manifesto from the forum post behind the confirmed NEUST admission-records exposure, adapted to 'Happy November 6,' and its greetz line names the author of that post. Content below the post is hidden until a reader replies to the thread. The post also makes unverified allegations about the personal conduct of a faculty member, which this site does not repeat. Deep Web Konek reported the claim, and on November 11, 2026, OneNews.PH, citing Deep Web Konek's intelligence assessment, named USLS and reported that more than 11,000 student profiles were accessed by 'pocherowithpetchay.' The institution has not issued a public statement. This entry is recorded as 'investigating': the claim has been reported by mainstream media, but neither USLS nor the National Privacy Commission has confirmed it.
On November 6, 2026, the Facebook page 'Nullsec Philippines' posted screenshots of a defacement of the e-learning site of a public high school in Metro Manila, signed by the personas 'BR4IN R00T' and 'ST4X.' The defacement page reads 'PWNED BY BR4IN R00T' with a short taunt about the site's security and a greetz line naming several handles seen in earlier Nullsec Philippines claims. The post links to an archive snapshot presented as a mirror of the defaced page. No data exfiltration is claimed. The school has not issued a public statement. This entry is recorded as 'unconfirmed' on the basis of the single threat-actor post, and the school's name is withheld pending verification.
On November 6, 2026, a Facebook account using the name 'Br4in r00t' posted a one-line profane message in Tagalog tagging a state university in Bicol Region, with two screenshots of a spreadsheet exported from the university's online registration and enrollment system. The screenshots show roughly 80 rows of 2026 college applicants with full names, applicant and exam control numbers, dates of birth (mostly between 2006 and 2009, so many applicants are minors or recent minors), entrance-exam scores and percentile ranks, and their first to third choices of degree program. The post makes no claim about how the data was obtained or how much more is held. The same handle signed a defacement of a Metro Manila public high school's e-learning site the same day. None of the personal data is reproduced on this site. The university has not issued a public statement, and this entry is recorded as 'unconfirmed' on the basis of the single threat-actor post.
On November 5, 2026, the Facebook page 'CrimsonSec Philippines,' signed by the persona 'Ph.0xUnknown404,' published a post under the hashtag MMM2026 claiming to release a database taken from the University of Camarines Norte (UCN) in Daet, Camarines Norte. The post claims 39,620 student records and 18,645 student accounts with cracked passwords, and includes a public download link presented as the dataset. It attaches a grid of student identification photographs and a screenshot of a dark-web forum listing that describes the dataset's tables: student, parent, staff-account, grades and financial-ledger data. The same actor first claimed access to the institution's student portal on August 1, 2026, which is tracked as a separate entry on this site. The download link and all personal data in the attachments are withheld here. On November 11, 2026, OneNews.PH, citing a Deep Web Konek intelligence assessment of underground disclosures from November 5 to 7, reported that CrimsonSec Philippines and a second group, GWAPINGS123, accessed UCN's full academic and financial database. UCN has not issued a public statement. This entry is recorded as 'investigating': the claim has been reported by mainstream media, but neither UCN nor the National Privacy Commission has confirmed it.
On November 5, 2026, a Facebook account using the name 'DNH Empanada45,' affiliated with Deathnote Hackers (DNH), addressed Eastern Visayas State University (EVSU) and its human resource management office under the hashtag MMM2026. The post claims the group had access to the institution's Human Resource Management Information System (HRMIS). It says the group chose not to dump the data after one of the institution's students contacted them, and that it is publishing the vulnerability as an unsolicited security assessment instead. Screenshots show a local folder holding what appears to be the HRMIS application source code and two SQL database files, one of them open on the institution's own employer record, beside the system's login page on an institutional subdomain. No employee records are shown and no data was released. BetterGov.PH listed EVSU among the systems reportedly affected on November 5, and Rappler and Newsbytes.PH reported the list. On November 11, 2026, EVSU said on its official Facebook page that its ICT Team, working with a white-hat hacker known as 'Liwat,' had addressed and mitigated a recent cybersecurity incident involving the university's online services. The statement does not name the HRMIS or the group behind the November 5 post, and does not say whether any personal data was accessed. This entry is recorded as 'resolved' on the basis of the university's statement that the incident was mitigated.