Cavite State University – General Trias City Campus (CvSU)

Update — school named: This entry was first published anonymized as "a state university campus in CALABARZON." On November 10 and 11, 2026, Unbox PH and OneNews.PH, both citing a summary by Deep Web Konek (DWK), named Cavite State University's General Trias campus among the institutions allegedly affected from November 5 to 7. Under the SchoolBreach.org methodology, a school named in mainstream media coverage is named here. The entry stays 'investigating': the university has not issued a public statement, and the NPC has not published a finding.

The posts include screenshots showing the full names, student numbers, usernames, and institutional email addresses of identifiable students and instructors. None of that information, and no database or table name that identifies the institution, is reproduced on this site.

What Happened

On November 4, 2026, the Facebook page The High Table published a post titled "Silence is no longer an option." It says the page had found security vulnerabilities in the website of the Cavite State University General Trias City Campus, and had formally reported them to the campus student government, the official campus student publication, and campus management. It says it provided a detailed report and gave them enough time to fix the issues, but that the vulnerabilities appeared to remain unresolved, and that changing account passwords "is not the same as fixing a security vulnerability." The post announced that the next day it would take part in the Deathnote Hackers (DNH) Million Mask March, crediting DNH Klammer, to bring the issue to public attention.

On November 5, 2026, the page followed with a post titled "The system went offline. The questions remain unanswered," apologizing for its "late participation in this year's Million Mask March." It says that after its first public statement the campus responded with a password rotation and then an apparent website maintenance page. It says it had documented findings for about a month, including evidence it believes shows database access, and listed what it called "some database findings." It closes by saying it will not publicly release the student information or credentials "for now," and demands an independent investigation, verified remediation, and accountability. The post carries the hashtags #MillionMaskMarch, #MMM2026, #DNH, and #DeathNoteHackers.

What the Post Claims and Shows

The post lists the following, totaling what it calls 117,000+ listed records:

• Student directory: 3,415 records with full names, student numbers, institutional email addresses, and enrollment status
• Current subject grades: 71,850 records across 2,891 students
• Historical grades: 23,815 records
• Add/drop records: 11,988
• Enrollment records: 1,817, with scholarship flags and admission dates
• Instructor directory: 89 records with full names and institutional email addresses
• Institutional email records: 3,440
• Administrator credentials: 7 records, described as having compromised passwords
• Default-password mapping information

Four screenshots accompany the post:

• A list of databases on a MySQL server, showing one database named for the campus system as an export, alongside the standard MySQL system databases.
• A table list with row counts for that database. It shows a student-grades table of about 73,000 rows in addition to the tables the post lists, and a small auxiliary credential-accounts table of four rows.
• A ten-row sample of the student directory, with full names, student numbers, institutional email addresses, and a status column.
• A ten-row sample of the instructor directory, with full names, usernames, institutional email addresses, and an active or inactive status.

The terminal prompt shows the queries were run as a local administrator on the actor's own machine, and the database name describes it as an export. Taken together, the screenshots indicate that a copy of the campus system's database was taken and loaded onto the actor's machine, rather than queried live on the campus server.

Update — November 7–8, 2026: Forum Post, Deadline, and DWK Report

On November 7, 2026, at 9:54 PM according to the forum's timestamp, an account named blackhoundtht posted the same text as the November 5 Facebook post on a dark-web forum, under a thread title naming the campus and saying its database had been breached. The account shows the forum's "Pwned" rank, a join date of November 2026, and a single post. The handle ends in "tht," matching both the initials of The High Table and the machine name shown in the terminal screenshots of the November 5 post, which ties the forum account to the same actor.

Deep Web Konek then published a #DataBreachAlert summarizing the claim. According to DWK, the actor gave the campus until November 14, 2026 to provide a credible update on the reported vulnerabilities, show verified remediation, and address the possible exposure of institutional records, and warned that the entire database could be released publicly if no verifiable action was taken by that date.

This changes the picture in two ways:

• The claim has been independently reported. Under this site's methodology, a DWK report raises a threat-actor claim from 'unconfirmed' to 'investigating'.
• There is now a release deadline. The November 5 post said the data would not be released "for now." The forum post and DWK's report make that conditional on the campus acting by November 14.

Update — November 10–11, 2026: Media Reports

On November 10, 2026, Unbox PH reported on Deep Web Konek's summary of 23 organizations allegedly hacked from November 5 to 7, put at over 600GB of data in total, and listed "Cavite State University – General Trias Campus" among the institutions allegedly affected. It gives no details for the campus, and says nothing in the summary had been confirmed beyond two government agencies' own notices.

On November 11, 2026, OneNews.PH reported on an intelligence assessment by Deep Web Konek covering underground disclosures from November 5 to 7, 2026, which lists 23 Philippine institutions, among them four educational institutions. It names the campus as "Cavite State University-General Trias Campus (CSU-GTC)" and reports that more than 117,000 records there were accessed by blackhoundtht, the forum account that reposted The High Table's claim. The report does not mention the November 14 deadline, and does not say whether the data was independently checked.

Why the Methodology Treats This as 'Investigating'

This entry names the institution and is tagged 'Investigating' because Deep Web Konek reported the claim and OneNews.PH then named the campus in mainstream coverage, after Unbox PH listed it the day before. It is not 'confirmed' because:

• DWK's report and the Unbox PH and OneNews.PH articles describe the claim; neither says the data was reviewed or validated
• The page's account of private reports to the student government, student publication, and management has not been confirmed by any of them
• The password rotation and website maintenance are described by the actor; this site has not independently confirmed them or linked them to the claim
• No NPC finding is available
• No public statement has been issued by the institution

If the university issues a statement or the NPC publishes a finding, this entry will be updated in line with the SchoolBreach.org methodology. This entry will also be updated after the November 14 deadline.

Threat-Actor Persona and Cross-References

The High Table has not previously appeared on this site. Its terminal prompt uses a short machine name matching the page's initials. The page presents itself as a finder who tried responsible disclosure first and went public only when the issues were not fixed, a framing that has recurred in several 2026 claims on this site.

On November 9, 2026, the same page addressed a private college in CALABARZON, claiming a 696-table database and exposed administrator accounts and login tokens, with terminal screenshots from the same machine name.

The posts tie the page to Deathnote Hackers (DNH). The November 4 post names the "DNH Million Mask March" and credits DNH Klammer, and the November 5 post carries the #DNH and #DeathNoteHackers hashtags. DNH Klammer also signed the same-day EVSU HRMIS access claim, posted by DNH Empanada45.

This is one of several Philippine school claims timed to the November 5 Million Mask March under #MMM2026. The others tracked on this site are the UCN student data release claim, the EVSU HRMIS claim, and the NEUST admission-records exposure. Posts from accounts within the same loose network are not treated as corroborating one another under this site's methodology.

Why This Claim Warrants Attention

• Administrator access to a grades system is an integrity risk, not only a privacy risk. With administrator credentials, an attacker could change grades, enrollment, or scholarship records, and such changes are hard to detect after the fact.
• Default-password mapping exposes every account that still uses it. If accounts are issued predictable default passwords, anyone who knows the pattern can log in as any student or instructor who never changed theirs.
• A password rotation does not remove the data already taken. The screenshots indicate a copy of the database is on the actor's machine. Rotating passwords and taking the site offline limit future access but do nothing about that copy.
• Personal data has already been published. The samples in the post show identifiable students' and instructors' names, student numbers, and emails on a public page.
• Release is held back only "for now," and there is a deadline. The actor has said the entire database could be released if the campus does not show verified remediation by November 14, 2026.

What Is Not Known

• The vulnerability. The posts do not name the flaw or how the database was reached.
• Whether the private reports were received. The student government, student publication, and campus management have not said publicly whether they received a report or what they did.
• Whether the flaw is fixed. The site was reportedly taken offline. Whether the underlying vulnerability has been found and fixed is not known.
• What the credential tables contain. The posts describe administrator passwords as compromised but do not show how they are stored.
• Whether the system serves other campuses. The database is named for one campus. Whether the same system or code runs at other campuses of the university is not known.

Recommended Actions for the Institution

1. 1.Treat the database as copied. Plan the response on the basis that every table listed is in the actor's hands.
2. 2.Find and fix the vulnerability before the site returns. Keep the system offline or restricted until the access path is identified and closed. A password rotation alone does not close it.
3. 3.Preserve logs before remediation. Copy web server, application, and database logs to isolated storage, covering at least the period since the first private report.
4. 4.Audit grades, enrollment, and scholarship records for changes made with administrator accounts, and compare them against backups from before the private report.
5. 5.Remove default passwords. Force a reset for every account still on a default or patterned password, and stop issuing predictable defaults.
6. 6.Rotate every credential the system uses, including database, administrator, and service accounts, and review the auxiliary credential accounts named in the screenshots.
7. 7.Notify the National Privacy Commission within 72 hours under RA 10173. Identifiable student and instructor data has already been published in the actor's screenshots, and the claimed copy covers academic and enrollment records.
8. 8.Issue a same-day public advisory to students and faculty explaining what is claimed, what has been done, and what they should do, including changing any reused password. Silence in the face of a public claim leaves the threat actor's framing as the only public narrative. The contrast example on this site is the Assumption College of Davao ICTC advisory, issued the same day as that claim.
9. 9.Request removal of the screenshots that show personal data, and preserve copies for the NPC filing.
10. 10.Check whether other campuses run the same system, and apply the same review there.
11. 11.Engage an external review of the system before it is brought back online.

How to Prevent This Pattern

1. 1.Publish a security contact and responsible-disclosure policy, and route reports to the IT office. The actor says it reported to the student government and student publication. A clear, monitored channel would have sent the report straight to the people who could fix it.
2. 2.Acknowledge disclosure reports and give a timeline. Finders who hear nothing tend to go public.
3. 3.Never issue predictable default passwords, and require a change at first login.
4. 4.Keep student-records databases off the public internet and reachable only from the application server.
5. 5.Log and alert on database exports and bulk reads so a full copy cannot be taken unnoticed.
6. 6.Use separate, least-privilege accounts for administrators, with multi-factor authentication.
7. 7.Fix the root cause before restoring service. Taking a site offline buys time; it is not remediation.