Eastern Visayas State University (EVSU)

Update — November 11, 2026: EVSU statement, status 'resolved': EVSU has publicly acknowledged "a recent cybersecurity incident involving the university's online services" and said it was addressed and mitigated with the help of a white-hat hacker. The full statement is reproduced in the Institution Statement section below. It does not name the HRMIS or the group behind the November 5 post, and it does not say whether personal data was accessed.

Update — November 12, 2026: Posts by the white-hat-styled page Liwat, published before and around the statement, appear to show logged-in access to student, enrollment, HR time-keeping and learning-management systems, and verbose database errors on the main website. See "Liwat's Public Posts Around the Statement" below.

This entry was first published anonymized as "a state university in the Visayas" and tagged 'unconfirmed', and was named and raised to 'investigating' after BetterGov.PH listed Eastern Visayas State University among the systems reportedly affected on November 5 and Rappler reported that list.

The post tags a student of the institution by name, and its screenshots show the institution's employer identifiers, tax identification number, and an account number, as well as file paths on the actor's machine. None of these is reproduced on this site.

What Happened

On November 5, 2026, the Facebook account DNH Empanada45 published a post addressed to Eastern Visayas State University (EVSU) and to the university's human resource management office, tagging both official pages. The post is signed "DNH@EMPANADA45 | DNH Klammer | DNH Kranos | DNH-PH | DNH-INT | Anonymous Ph" and carries the hashtags #MMM2026, #Philippines, and a hashtag naming the institution. It quotes the "Remember, remember, the 5th of November" verse associated with the November 5 mask-themed protest day.

The post says that one of the institution's students recently contacted the group "regarding this situation," and that this changed the group's approach. Rather than "dumping everything," it says, the group will highlight the vulnerabilities and security issues that need immediate attention, describing the post as an unsolicited vulnerability assessment and penetration test (VAPT). It adds that the decision to hold back should not be taken as a sign that everything is fine, and that the institution's HRMIS still needs a serious security review.

What the Screenshots Show

• An application folder for the HR system. A file-manager window shows a folder named for the institution, inside a parent folder that suggests the actor keeps it alongside other government-related material. It contains API, application, database, and schema subfolders, two SQL files named for the HRMIS (one apparently a schema update), a license file, and a readme. The layout is consistent with the full application source tree plus database files, rather than a few pages saved from a browser.
• A database file open on the institution's employer record. A text editor shows one of the SQL files open read-only. The visible part contains the definition of an agency-settings table and a single row for the institution: its name and abbreviation, street address, telephone and fax numbers, email and website, salary schedule, government-contribution employer identifiers and share settings, tax identification number, an account number, and its vision and mission statements. No individual employee records are visible.
• The live HRMIS login page. A browser window shows the HRMIS login page on an institutional subdomain. The page footer credits a national government agency's IT division, which suggests the HRMIS is a government-developed platform used by other public agencies as well.

The screenshots do not show how the files were obtained. They show an HR system's source code and database files on the actor's machine, with institution-specific content in one table, and the system's login page still live.

The University's Statement

On November 11, 2026, six days after the post, EVSU published a statement on its official Facebook page. It says that the university's Information and Communications Technology (ICT) Team, working with a white-hat hacker known as "Liwat," had "successfully addressed and mitigated a recent cybersecurity incident involving the university's online services." According to the statement, Liwat worked with the ICT Team through responsible vulnerability disclosure to identify potential security vulnerabilities, provide recommendations, and put measures in place to strengthen the university's website security.

The November 5 post said a student of the institution had contacted the group about the issue. The statement does not say whether Liwat is connected to that contact, and this site does not speculate about who Liwat is.

Liwat's Public Posts Around the Statement (November 9–11, 2026)

Before and around the university's statement, the Facebook page Liwat ("Liwat Cybersecurity | Whitehat") published three posts addressed to EVSU. They were reviewed via screenshots provided to this site on November 12, 2026.

• About November 9: offer of help. A post greeting the university president on his birthday says Liwat has a "huge gift" for the IT department. It says a "greyhat/hacktivist" had recently published claims about EVSU, that Liwat left that group because the claims were posted against its wishes, and that Liwat would now help the university. It tells the IT department not to go home yet.
• About November 9: screenshots of access and a warning. A second post asks whether the developers are confident the website is secure. It warns that if the university will not coordinate and another greyhat targets it before the findings are fixed, "all user data" could be sold. It also says that by the next day Liwat might have access as a different user type and might dump the data, and that many PDFs hold important details, "especially the salary rate of all employees" and student details. The post's screenshots, partly redacted by the actor, appear to show logged-in views of a student portal, an enrollment page, a student information system's student directory, an employee time-keeping and HR dashboard, and an instructor dashboard of a learning management system, all on institutional subdomains. The post had 14 further images that were not reviewed.
• About November 11: disclosure on condition of public acknowledgment. A third post says Liwat found multiple vulnerabilities across the website and offers to meet the IT team "tomorrow at 7:00 PM." Liwat's "only one condition" is that the university acknowledge the disclosure in a post on its official Facebook page. The screenshots show verbose database error messages from the web application. These expose an internal network address and application file paths, and record failed database log-ins for common default account names. The address and paths are not reproduced on this site.

The university's November 11 statement, quoted in the Institution Statement section below, publicly credits Liwat. It meets the condition set in the third post. The statement does not say which systems Liwat's findings covered.

These posts suggest access to more systems than the HRMIS named in the November 5 claim: student, enrollment, time-keeping and learning-management systems. They are posts by the actor, not findings by the university, and the screenshots do not show bulk records. The threat to sell or dump data if the university did not coordinate is not consistent with responsible-disclosure practice, whatever the stated intent.

Liwat has made similar public approaches to other Eastern Visayas institutions, tracked anonymously on this site: a private college (November 4) and two state universities (November 8 and November 12).

Why the Methodology Treats This as 'Resolved'

This entry is tagged 'Resolved' because:

• EVSU publicly acknowledged a recent cybersecurity incident involving its online services, six days after the November 5 post and with no other EVSU incident publicly reported in that period
• The university says the incident was addressed and mitigated, with a named, if pseudonymous, white-hat collaborator

The statement leaves several things open:

• It does not name the HRMIS or the group behind the November 5 post, so it does not confirm the specific claim
• It does not say whether personal data was accessed or copied, or whether the database files shown in the post contain employee records
• It describes strengthening website security, while the post concerned the HR system on its own subdomain
• No NPC finding is available. The NPC said on November 6 that it had not received breach notifications from the agencies concerned and would coordinate with them to verify the reports

If EVSU or the NPC says more about the scope of the incident, this entry will be updated in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

DNH refers to Deathnote Hackers, a group with several prior entries on this site:

• A 2025 website breach at Romblon State University, claimed under the name DeathNote Hacker Philippines.
• The 2025 UP Mindanao data leak, released by an actor claiming DNH affiliation.
• The May 2026 DepEd training-platform CSV leak, posted under the joint Nullsec Philippines and Deathnote Hackers International banner and co-credited to Klammer.

DNH Klammer in this post's signature matches that alias. DNH Empanada45 and DNH Kranos have not previously appeared on this site. The signature's DNH-PH and DNH-INT labels match the Philippine and international branding seen in the DepEd claim.

The #MMM2026 hashtag places this post in the same November 5 campaign as the UCN student data release claim, posted the same day by CrimsonSec Philippines. Both posts tie their claims to the mask-themed protest day. Posts from accounts within the same loose network are not treated as corroborating one another under this site's methodology.

Why This Claim Warrants Attention

• HR systems hold some of the most sensitive employee data. An HRMIS typically stores government identification numbers, tax and contribution records, salaries, payroll bank details, home addresses, and family information for every employee. That set supports identity theft, loan fraud against contribution accounts, and payroll diversion.
• Source code access makes further attacks easier. With the application's source, an attacker can search offline for flaws, hard-coded credentials, and configuration secrets without generating any traffic the institution could detect.
• The platform appears to be shared across public agencies. If the HRMIS is a government-developed system used elsewhere, a flaw found in one deployment may exist in every deployment, and the actor's folder layout suggests it holds other government material.
• Holding back is not remediation. The post says the data was not dumped. That is the actor's choice, which can change, and it does nothing to stop others who find the same flaw. The post states plainly that the system is still exposed.
• The institution has been publicly told the system is vulnerable. Naming the system and its subdomain in a public post invites other actors to look for the same weakness.

What Is Not Known

• How the files were obtained. The post does not name a vulnerability. Candidates include an exposed backup or source archive, a publicly reachable repository or directory listing, a compromised administrator account, or an injection flaw.
• What the database files contain. Only the agency-settings table is shown. Whether employee, payroll, or contribution records are included, and how many, is not established.
• Whether the copy is the institution's live data. The folder could be a full copy of the institution's deployment or a generic copy of the platform with the institution's settings, which would carry much less personal data.
• Whether other deployments are affected. The post concerns one institution, but the platform may be used by other agencies.
• Whether the statement covers the HRMIS. EVSU's November 11 statement refers to its online services and website security without naming the HR system.

Recommended Actions for the Institution

EVSU says the vulnerability has been addressed. The steps below remain relevant to confirming the fix covers the HR system and to protecting employees if its data was copied.

1. 1.Treat the HRMIS and its database as compromised until shown otherwise. Plan the response on the basis that the full database and source code are in the actor's hands.
2. 2.Restrict access to the HRMIS while the exposure is found. Place it behind a VPN or an IP allow-list for HR staff until the access path is identified and closed.
3. 3.Look for exposed files on the web server. Check for publicly reachable backups, SQL dumps, source archives, version-control folders, and directory listings on the HRMIS subdomain and the main site. Remove them, and review web server logs for anyone who downloaded them.
4. 4.Preserve logs before remediation. Copy web server, application, database, and authentication logs to isolated storage before patching or restarting anything.
5. 5.Rotate every credential the application uses, including database accounts, API keys, and any secrets in configuration files, and force a password reset for all HRMIS users.
6. 6.Notify the National Privacy Commission within 72 hours under RA 10173. The legal trigger is risk to personal data, not certainty of exfiltration. A possible copy of an HR database holding employee government identifiers and payroll data is well inside the threshold.
7. 7.Contact the platform's developer. If the HRMIS is a government-developed system, its developer should be told so it can check whether the flaw affects other agencies and issue a fix.
8. 8.Issue a same-day public advisory to employees. Tell staff what is claimed and warn them about fraud using their government identifiers, contribution accounts, or payroll details. Silence in the face of a public claim leaves the threat actor's framing as the only public narrative. The contrast example on this site is the Assumption College of Davao ICTC advisory, issued the same day as that claim.
9. 9.Ask employees to watch their contribution and loan accounts for unexpected activity, and set up a point of contact for concerns.
10. 10.Engage an external review of the HRMIS deployment covering the application, the server, and any other systems sharing its infrastructure.

How to Prevent This Pattern

1. 1.Keep HR and payroll systems off the public internet. Systems used only by HR staff should sit behind a VPN or an allow-list, not on a public subdomain.
2. 2.Never store backups, SQL dumps, or source archives in the web root. These are among the most common ways whole databases leave public institutions.
3. 3.Keep secrets out of source code. Store database credentials and API keys outside the application directory so a source leak does not also leak access.
4. 4.Apply vendor and developer updates promptly for shared government platforms, and follow the developer's security advisories.
5. 5.Monitor for bulk downloads and unusual access on HR systems, which hold a small number of very sensitive records.
6. 6.Collect and retain only the employee data the HR function needs, and archive records of separated employees out of the live system.
7. 7.Publish a security contact and responsible-disclosure policy. The post says a student contacted the group about this issue. A monitored private channel gives finders, including students, somewhere to report a flaw other than a public page.