Bicol University

What Happened

On April 27, 2020, the official website of Bicol University (bicol-u.edu.ph) was defaced by a group of four student hackers. The attack was a direct protest against Administrative Order No. 91, Series of 2020, which mandated that classes would resume on May 2 via remote teaching and distance education strategies, with the semester ending on May 20, 2020.

The hackers replaced the homepage with a message directed at the university administration:

"Bicol University, the strategies you have presented only favors the privileged. Not all are privileged. We ask for a revision of the said admin order for the betterment of BUeños."

The group described their action as "the most notorious act ever witnessed in the history of the excellence of Bicol University." They signed off with the hashtags #EndTheSemester, #MassPromotion, and #NoOneGetsLeftBehind.

The Hackers

The four individuals operated under the usernames h1j4ck3r, blis5ful, d00mbring3r, and estrang-the-hero. Notably, the same group was responsible for an earlier defacement of the Bicol University website in November 2016, when they protested a controversial statement by the University Student Council regarding the burial of Ferdinand Marcos.

Context

The attack occurred during the height of the #MassPromotionNow movement on social media. Students across the Philippines were calling on educational institutions to grant passing grades to all students and end the semester early, rather than forcing online classes during a pandemic.

As student leader Irish Mae Barrion Torres explained: "The reason why lots of students oppose online classes is because it is anti-poor and there is little to no consideration to the students at all. Giving passing grades to all students and ending the semester are the most humane decisions in the middle of this crisis."

Torres noted that as a state university, the majority of Bicol University students came from poor families, making online classes impractical: "Online classes will not work in Bicol University considering that this is a state university and the majority of the students came from poor families."

Impact

• The screenshot of the defaced website went viral overnight on social media
• The incident became a symbol of student resistance to inequitable pandemic education policies
• It highlighted the digital divide affecting students at state universities
• The website was taken offline temporarily

How to Prevent This

1. 1.Implement a Web Application Firewall (WAF) — to detect and block common defacement vectors
2. 2.Keep CMS and server software updated — patch known vulnerabilities promptly
3. 3.Use strong authentication for admin panels — enforce MFA and restrict access by IP
4. 4.Monitor file integrity — deploy tools that alert on unauthorized changes to website files
5. 5.Maintain offline backups — ensure rapid restoration capability when defacement occurs