A public resource tracking cybersecurity incidents affecting Philippine schools. Because student data deserves better protection.
Schools hold some of the most sensitive data imaginable — children's personal information, family details, medical records. Yet most Philippine schools lack the resources and awareness to protect this data. This tracker exists to raise awareness and drive change.
Most schools don't know breaches are happening in Philippine education. Visibility is the first step to action.
By tracking incidents, we identify common attack vectors and vulnerabilities so schools can prioritize defenses.
Every breach listed here includes lessons learned. We want schools to learn from others' mistakes, not their own.
Free tools and educational resources to assess your school's security posture and build a culture of data protection.
On May 3, 2026, the Facebook account '4b1smo' (a newly-promoted Nullsec Philippines-affiliated account) posted a one-line claim addressed to a foundation college in Mindanao, framed as 'time to fix [institution] - Main Page weak security lolx' and accompanied by an archive.md snapshot URL as evidence. The post does not claim data exfiltration, does not name a vulnerability class, and does not describe what 'weak security' refers to beyond the linked screenshot. Nullsec Philippines re-shared the post on its main page within minutes. The institution has not issued a public statement. The institution name, the institution's province, and the archive snapshot URL have been withheld in public display pending corroboration.
On May 2, 2026, the Facebook account 'Nullsec Philippines' publicly posted a one-line claim addressed to a technical institute in Laguna and linked to a defacement page hosted off-domain on a third-party Philippine content platform — not on the institution's own infrastructure. The post also linked to a public archive snapshot of that page. The post is unusual within the Nullsec batch: no school-domain subdomain is named, no data is claimed, and no specific access vector is described — the entire public footprint of the claim is a single off-domain HTML file that mentions the school. The relationship between the institution and the third-party platform has not been independently verified, and the school has not issued a public statement. The institution name, the institution's city, and the specific URLs of both the defacement page and its archive snapshot have been withheld in public display pending corroboration, because each of those URLs would otherwise reverse-identify the school.
Fawkes Pilipinas, affiliated with Nullsec Philippines, claimed to have defaced the A private university in Cebu City Publishing House subdomain. The group posted a defacement page at A private university in Cebu City and stated they identified vulnerabilities in the subdomain but claimed no data was harmed.