Nueva Ecija University of Science and Technology (NEUST)

Update — de-anonymized and confirmed: This entry was first published as an anonymized 'investigating' entry for "a state university in Central Luzon." After the university published its own advisory acknowledging the incident, it has been updated to name the institution and marked 'confirmed', in line with the SchoolBreach.org methodology.

What Happened

On November 5, 2026, at 3:32 AM according to the forum's timestamp, a user under the alias imken opened a thread on a dark-web forum titled with the name of Nueva Ecija University of Science and Technology (NEUST). The post said that in the course of an "ongoing audit," the author found the university had neglected the security of its students, and that the personal information of more than 81,000 students had been exposed: full names, home addresses, contact numbers, birthdates, parents' names, and academic records. It said the university "left your data wide open for anyone to take." Most of the post was a manifesto for the November 5 Million Mask March, closing with "MMM2026."

The same day, Deep Web Konek published a summary of the post under #MMM2026, noting that the university had not yet been confirmed as acknowledging the incident.

The University's Advisory

NEUST then published a Public Advisory titled "Notice on the Reported Exposure of Archived Admission Records" on its official Facebook page. In it, the university:

• Confirmed the exposure. Its security team received a report about an online post containing approximately 81,000 records and, after initial verification, confirmed the records are associated with college applicants who applied between January 2024 and May 2026.
• Identified the source. The records are personal details submitted during the college admission application process, held in the university's archived College Admission Database, which is no longer part of the active admission system.
• Limited the scope. It found no evidence that the Student Portal or the Integrated University System was breached, and said those systems remain operational.
• Described its response. Its security team "immediately addressed the identified vulnerability" and put measures in place to prevent further access, with further assessments under way to validate the affected records and assess risks.
• Cited its legal basis. It said it is addressing the incident under the Data Privacy Act of 2012 (RA 10173), and apologized for the concern caused.

The full text is reproduced in the university's statement on this page.

What the Advisory Settles and What It Leaves Open

The advisory confirms that the records are real and came from the university, and it narrows the affected population from "students" to admission applicants from January 2024 to May 2026. Many of those applicants will have enrolled, but many will not, and most will have been minors or recent minors when they applied.

It does not say:

• Which data fields were exposed. The advisory refers to "personal details submitted as part of the college admission application process." The specific fields listed by the threat actor, such as home addresses, parents' names, and academic records, are consistent with an admission application but are not individually confirmed.
• What the vulnerability was or how long the archived database was reachable.
• Whether the data has been distributed. The forum post's red-barred element was not visible in the circulated screenshot, and the advisory does not say whether the records were downloaded by others or offered for sale.
• Whether the NPC has been notified and whether affected applicants will be contacted individually.

Threat-Actor Persona and Cross-References

The alias imken had not previously appeared on this site. The forum account showed a join date of October 2026. The greetz line named W3MBY_1337, Assembly, KAVS88, Ivan, Primo Philippines, Ph.03STR0Y3R, and Unkown Slayer. Ph.03STR0Y3R resembles D3STROY3R, a handle credited in the Laguna private-university CrimsonSec claim, but the resemblance is not treated as attribution.

The post was one of several Philippine school claims timed to the November 5 Million Mask March under #MMM2026. The others tracked on this site are the UCN student data release claim, the EVSU HRMIS access claim, and the CvSU General Trias student records claim. This is the first of those claims to be publicly acknowledged by the institution.

On November 11, 2026, OneNews.PH, reporting on a Deep Web Konek intelligence assessment of underground disclosures from November 5 to 7, listed NEUST among four educational institutions in the assessment and reported that imken accessed "over 81,000 student records." NEUST's own advisory describes the records as belonging to college applicants rather than enrolled students. A day earlier, Unbox PH had listed NEUST among the institutions allegedly affected, without further detail.

Why the University's Response Matters

The advisory followed the claim quickly, named the affected system and population, and stated what the university had done. That gives applicants and parents an official account to act on instead of only the threat actor's. It also shows a pattern worth noting for other institutions: an archived database that is no longer in active use was still reachable, and old data held for convenience became the exposure.

Recommended Next Steps for the University

1. 1.Notify the National Privacy Commission within 72 hours of confirming the breach under RA 10173, if not already done, and say so publicly.
2. 2.Notify affected applicants directly, including those who never enrolled, and tell them which data fields were involved.
3. 3.Publish the specific data fields exposed, so applicants and parents can judge their own risk.
4. 4.Warn applicants about targeted scams. Admission data supports convincing messages about scholarships, enrollment fees, or entrance results.
5. 5.Monitor the forum thread and related channels for any sale or release, and preserve evidence for the NPC and law enforcement.
6. 6.Review retention for archived databases. Delete or take fully offline applicant records the university no longer needs.
7. 7.Publish a follow-up once the security assessment is complete, as the advisory says it will.

How to Prevent This Pattern

1. 1.Inventory archived and legacy databases, not only active systems. Retired systems are often left reachable and unpatched.
2. 2.Apply retention limits to applicant data. Applicants who did not enroll rarely need to be kept in any online system.
3. 3.Take archives fully offline or behind authenticated, internal-only access.
4. 4.Monitor for bulk access on every database holding personal data, including archives.
5. 5.Pre-stage a breach advisory template. NEUST's quick, specific advisory is the kind of response other institutions should be ready to make.
6. 6.Publish a security contact and responsible-disclosure policy so finders have a private channel.