Back to Breach Tracker
Database Leak
CriticalConfirmed

DepEd Division of Laguna

Quantum Security Group leaked 7 million database records from DepEd Division of Laguna, including plaintext passwords, employee details, and multiple internal system databases spanning email, document tracking, and HR systems.

October 4, 2025Laguna, CALABARZON7,000,000+ records affected

Key Facts

Date of Incident
October 4, 2025
Date Discovered
October 4, 2025
Records Affected
7,000,000+
Source
Deep Web Konek
Data Types Exposed
Employee namesEmail addressesPhone numbersUsernamesPasswords (plaintext)Job positionsSchool affiliationsProfile imagesOrganizational structure
Response / Action Taken

DepEd Laguna confirmed server breach via Facebook advisory, advised personnel to change passwords and enable 2FA.

What Happened

On October 4, 2025, cybersecurity monitoring group Deep Web Konek reported that the Quantum Security Group claimed responsibility for breaching the DepEd Division of Laguna, leaking 7 million database records.

The group released multiple compressed database files including:

  • db_stars.tar.gz
  • dcp.tar.gz
  • deped_tar.gz
  • emailsy1.tar.gz
  • office_letter.tar.gz
  • phpmyadmin.tar.gz
  • trackit2025.tar.gz

The group stated the breach was meant as a "lesson" regarding government negligence, declaring: "Corruption in the government is the real security breach."

As of reporting, DepEd Laguna had not released an official statement confirming or addressing the breach.

Data Exposed

  • User identification numbers and school IDs
  • Employee names (first, middle, last)
  • Email addresses and phone numbers
  • Usernames and plaintext passwords
  • Job positions and role assignments
  • School and district affiliations
  • Profile images and client photos
  • Organizational structure details

Why This Breach Is Critical

The exposure of plaintext passwords across 7 million records means every DepEd Laguna staff account is immediately compromised. Staff who reuse these credentials for personal email, banking, or social media face cascading account takeovers. The release of the phpMyAdmin database backup also suggests the attackers had full database administrator access.

How to Prevent This

  1. 1.Eliminate plaintext password storage immediately — migrate to bcrypt or Argon2 hashing with mandatory password resets for all users
  2. 2.Restrict phpMyAdmin access — never expose database management tools to the internet. Restrict to VPN-only access with MFA
  3. 3.Encrypt database backups — compressed database files (.tar.gz) should be encrypted at rest so they are useless if exfiltrated
  4. 4.Implement centralized identity management — use a single sign-on (SSO) system with MFA across all DepEd division platforms
  5. 5.Monitor for unusual database access — alert on bulk exports, phpMyAdmin logins from unfamiliar IPs, and large file transfers
  6. 6.Coordinate incident response with DICT — establish pre-arranged communication channels for rapid response when breaches occur

Sources & References

  1. [1]
    Deep Web Konek — DepEd Laguna data breach: 7 million records leaked by threat actors (Oct 4, 2025)
  2. [2]
    DepEd Laguna (Facebook) — Official DepEd Laguna advisory: Security Breach Notification — confirms server breach, advises password changes
  3. [3]
    DepEd Laguna (Facebook post) — Official DepEd Laguna advisory post: Security Breach Notification — confirms server breach
  4. [4]
    PSA Intelligence — Recent cybersecurity incidents report — includes DepEd Laguna breach by Quantum Security Group (Oct 5, 2025)
DepEdLagunaCALABARZONQuantum Security Groupplaintext passwordsDeep Web Konek