DepEd Ilocos Norte & Aurora Divisions

What Happened

Cybersecurity monitoring group Deep Web Konek reported that the Quantum Security Group claimed responsibility for breaching two additional DepEd regional offices: Ilocos Norte and Aurora.

DepEd Ilocos Norte: Over 3 million records were allegedly exfiltrated across 17 databases and 155 CSV files.

DepEd Aurora: A full database and backup file were obtained. The group characterized the Aurora system as "weak" and claimed no data deletion occurred during the intrusion.

The group issued taunting messages including "expect consequences, expect exposure" and referenced a "DepEd Breached Club," suggesting they view DepEd's regional offices as systematic targets.

As of reporting, neither DepEd nor the affected regional offices had issued statements regarding these incidents.

Related Prior Incident

In February 2024, DepEd Ilocos Sur's Facebook page was hacked, prompting the office to warn the public against transacting via Facebook and to seek assistance from the Ilocos Sur Provincial Cyber Response Team Office. While this was a social media account compromise rather than a database breach, it demonstrates the broader pattern of DepEd offices in the Ilocos region being targeted by threat actors.

Data Exposed

Personal Information (PI):

• Full names and usernames
• Email addresses and contact numbers
• School names and physical addresses
• Job positions

Sensitive Personal Information (SPI):

• Birth dates, gender, and civil status
• TIN (Tax Identification Numbers)
• PhilHealth identification numbers
• BP numbers
• Educational backgrounds

Why This Breach Is Critical

The exposure of TIN numbers and PhilHealth IDs alongside names and birth dates creates severe identity theft risk. These are government-issued identifiers that cannot be easily changed and can be used for:

• Filing fraudulent tax returns
• Making unauthorized PhilHealth claims
• Opening bank accounts or credit lines under stolen identities

This breach, combined with the DepEd CAR and DepEd Laguna breaches by the same group, reveals a systematic campaign by Quantum Security Group targeting DepEd regional offices across the Philippines.

How to Prevent This

1. 1.Encrypt all government-issued identifiers — TIN, PhilHealth, and other national IDs must be encrypted at rest in databases
2. 2.Audit all DepEd regional office systems — given the systematic targeting, all DepEd divisions should undergo immediate security assessments
3. 3.Implement network security baselines — establish minimum security standards that all regional offices must meet
4. 4.Restrict database exports — prevent bulk CSV and database file exports without multi-level approval
5. 5.Centralize security monitoring — deploy a shared security operations center (SOC) that monitors all DepEd regional systems for intrusion indicators
6. 6.Report to NPC — file breach notifications for all affected data subjects as required by the Data Privacy Act