DepEd Online Voucher Application Program (OVAP)

What Happened

Cybersecurity researcher Jeremiah Fowler, working with vpnMentor, discovered a non-password-protected cloud database containing 153.76 gigabytes of data covering 210,020 records. The database was associated with the Online Voucher Application Program (OVAP), a digital platform developed by the Department of Education (DepEd) and the Private Education Assistance Committee (PEAC).

The OVAP platform allows eligible senior high school students to apply for vouchers to cover the costs of education in private institutions. Students and parents submit applications and required documents electronically through the platform.

Data Exposed

The exposed database contained highly sensitive personal information including:

• Tax filings and financial records
• Voucher applications with personal details
• Consent forms signed by parents
• Government certifications and certificates of employment
• Death certificates and other official documents
• Profile photos (image files) of school children
• Student and parent personal identifiable information (PII)

Impact

Fowler warned that exposing how much an individual earns and where they are employed could put them at risk of financial fraud, phishing attempts, or identity theft. The exposure of children's photographs alongside their personal information is particularly concerning.

The database was stored without password protection and was accessible to anyone with an internet connection.

Response

Fowler initiated a responsible disclosure notice to both DepEd and the National Privacy Commission (NPC). The NPC responded swiftly, confirming that they secured the compromised database and commenced further investigations.

However, critical details remain unclear, including the ownership and management of the database, the duration of exposure, and whether unauthorized access occurred before discovery.

How This Attack Works

This was a misconfigured cloud storage incident. The database was deployed without any authentication — no password, no access key, no firewall rules. Anyone with the URL could access all 210,020 records. Cloud misconfigurations like this are one of the most common causes of data exposure globally.

How to Prevent This

1. 1.Enable authentication on all databases — never deploy a cloud database without requiring login credentials, even in development or staging environments
2. 2.Use cloud security posture management (CSPM) tools — services like AWS Config, Azure Security Center, or open-source tools like ScoutSuite can automatically detect misconfigured storage buckets and databases
3. 3.Restrict network access — configure firewalls and security groups so databases are only accessible from authorized IP addresses or VPNs, never from the open internet
4. 4.Enable access logging — turn on audit logs for all database access so you can detect unauthorized access quickly
5. 5.Apply data minimization — do not collect sensitive documents like tax filings, death certificates, or children's photos unless absolutely necessary for the program
6. 6.Conduct regular security audits — schedule quarterly reviews of all cloud resources to check for misconfigurations
7. 7.Require vendor security assessments — if a third-party platform handles student data, require them to demonstrate SOC 2 compliance or equivalent security certifications