A private college in Eastern Visayas

Single-source notice: This incident is based on a single public Facebook post by a self-identified actor, reviewed via screenshots provided to this site. No mainstream news outlet has reported on it, no independent researcher has corroborated it, and the institution has not issued a public statement. The claim remains unverified and the institution's name has been redacted pending verification.

What Happened

On November 4, 2026, the Facebook page Liwat posted a link to a section of a private college's website called "From our contributors," with two screenshots of that section. The post itself is a statement about student rights: "Power is not a privilege to silence students. Education should never be held hostage by financial difficulties, and every complaint deserves to be heard." It ends "WE ARE WATCHING," "STUDENT VOICES MATTER. JUSTICE MUST PREVAIL," hashtags including #StudentRights and #StopAbuseOfPower, and the signature "-Liwat."

What the Screenshots Show

The screenshots show the college's live website in an incognito browser window. Under "From our contributors," at least five entries are dated 2026-11-04 and credited to "ANON":

• Two entries, in Filipino, tell the college to take its website down if it has no cybersecurity expert, call the site "vibecoded," and tell it to deal with student complaints.
• One says "We see. We hear. We demand answers," and directs readers to the Liwat Facebook page.
• One says "We are always standing besides the students."
• One says "I have all info that I have."

A partly visible further entry appears to refer to a database policy test and an "approved" status. That may mean the actor inserted the entries directly into the site's backing database so that they appeared already approved, without passing through any moderation step. The screenshot is cropped, so this is an inference, not something the post states.

No administrative screens, databases or personal records are shown.

Why the Methodology Treats This as 'Unconfirmed'

This entry is fully anonymized and tagged as 'Unconfirmed' because:

• The only public source is the actor's own Facebook post
• No corroborating media coverage has been observed
• No NPC finding is available
• No public statement has been issued by the institution
• The only data claim, "I have all info," is vague and unsupported by anything in the post

If the institution issues a statement, if reputable Philippine media independently reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

Liwat describes itself as "Liwat Cybersecurity | Whitehat" and says its focus is the security of websites in Region 8. This is the earliest school post by the page reviewed for this site. In later posts the page says it left a "greyhat/hacktivist" group after that group published claims against another institution, and it has since publicly pressed several Eastern Visayas institutions to contact it about vulnerabilities. Related entries:

• A state university in Eastern Visayas, CMS content tampering (November 8, 2026)
• A state university in Eastern Visayas, student portal access claim (November 12, 2026)
• The EVSU HRMIS entry, where the university's November 11 statement credits a white-hat hacker known as "Liwat" with helping mitigate an incident

This post is the only one reviewed in which the page uses the "WE ARE WATCHING" protest framing rather than an offer to disclose vulnerabilities.

Why This Claim Warrants Attention

• Anyone could publish on the college's website. If outsiders can post to a public section of the site, it can also be used for phishing links, false announcements or scam payment instructions.
• The site may expose its database directly to visitors. If the entries were written straight into the database, other tables behind the site may also be readable or writable.
• The actor claims to hold "all info." The claim is vague, but it should be checked against the site's database and logs.

What Is Not Known

• How the entries were added: a public form without moderation, an exposed database API, or administrative access.
• Whether any data was read or copied, and what "I have all info" refers to.
• Whether the entries have been removed and the weakness fixed.

Recommended Actions for the Institution

1. 1.Remove the injected entries and close the write path. Check whether the contributors section accepts unauthenticated submissions and whether moderation can be bypassed.
2. 2.Review the database access rules behind the website, especially any rules that let anonymous visitors insert rows or set their own approval status.
3. 3.Check logs for reads of other tables, particularly any holding student, applicant or payment data.
4. 4.Rotate keys and administrator credentials used by the website and its hosting or database provider.
5. 5.Notify the National Privacy Commission within 72 hours under RA 10173 if the review finds personal data was accessed.
6. 6.Issue a short public advisory telling students and parents to ignore the injected messages and to trust only announcements from official channels.

How to Prevent This Pattern

1. 1.Never trust the browser to enforce approval. Approval status and similar fields should only be set on the server.
2. 2.Deny anonymous writes by default in database security rules, and test each rule before launch.
3. 3.Have AI-assisted or rapidly built sites reviewed for access-control mistakes before they go live.
4. 4.Moderate every public submission before it appears on the site.
5. 5.Publish a security contact and responsible-disclosure policy so finders have a private channel.