A private technological institute in Metro Manila

Single-source notice: This incident is based on a Facebook post by CrimsonSec Philippines and a matching dark-web forum post, reviewed via screenshots provided to this site. No mainstream news outlet has reported it, no independent researcher has corroborated it, and the institution has not issued a public statement. The claim remains unverified and the institution's name has been redacted pending verification.

The post includes a download link to an archive presented as the full dump, and technical details of how the data was retrieved. Neither the link nor the technical specifics, such as the query used, field names, function names, or database name, are reproduced on this site. The attached spreadsheet image is blurred in the post itself; no personal data from it is reproduced here.

What Happened

On November 8, 2026, the Facebook page CrimsonSec Philippines published a post headed with the initials of a private technological institute in Metro Manila and laid out as a security report, with Findings, Attack Surface, and Impact sections. It closed with a download link and the signature "~CSP."

The post carried two images. One is a screenshot of a dark-web forum post with the same text, from an account with the forum's "Breached" rank, a join date of November 2026, and a single post. The other is a blurred spreadsheet with the institution's logo over it.

What the Post Claims

• 17,114 full applicant records exposed without authentication. The post says an applicant-information endpoint in the institution's GraphQL API returned records to anyone, a thousand at a time, so the whole set could be pulled with a few requests from an ordinary browser in under 30 seconds.
• Personal data in each record: name, personal email, mobile number, Learner Reference Number, permanent address, date of birth, religion, citizenship, and a registration identifier.
• Unauthenticated file uploads. The post says an upload function let anyone write files to the server, choosing the folder and file name.
• Unauthenticated changes to the system. It says actions that change data, including deleting curriculum records and changing passwords, could be called without logging in.
• The firewall did not help. It says the web application firewall in front of the system did not stop the scraping.
• A test system with real data. The post's impact section says the system is a test instance that "still exposes complete schema & PII."
• A public download. The post links to an archive on an anonymous file-sharing site, presented as the dump.

Why the Methodology Treats This as 'Unconfirmed'

• The only public sources are the threat actor's own Facebook and forum posts
• No corroborating media coverage has been observed
• No NPC finding is available
• No public statement has been issued by the institution
• This site has not downloaded or reviewed the linked archive

If the institution issues a statement, if reputable Philippine media reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

CrimsonSec Philippines has several earlier claims on this site: the student portal access claim at the University of Camarines Norte (August 1, 2026), the breach-and-defacement claim at a private university in Laguna (August 11, 2026), and the student data release claim at the same university (November 5, 2026).

This post differs from CrimsonSec's earlier ones. It is written as a technical report rather than a manifesto, and it is signed "~CSP" rather than by a named persona. As in the November 5 Bicol release, it pairs the Facebook post with a dark-web forum listing from a newly created forum account.

The post does not mention the November 5 Million Mask March, but it came three days later from one of the groups active that week and follows the same pattern, so this site counts it with the #MMM2026 wave of school claims.

Why This Claim Warrants Attention

• Learner Reference Numbers are permanent identifiers. An LRN follows a student through basic education and is used for records and benefits. Combined with name, birthdate, and address, it supports identity fraud.
• Many applicants will be minors or recent minors, and the data includes religion, which is sensitive personal information under RA 10173.
• The data is offered for download. If the link works, anyone can obtain it.
• Unauthenticated writes are worse than a leak. A public upload function and password-change action, if real, could let an attacker plant malicious files or take over accounts.
• Test systems are not exempt. A test environment holding real personal data is subject to the same legal duties as production. Labelling it "test" does not reduce the harm.

What Is Not Known

• Whether the data is real and matches the institution's records.
• Whether the test system shares accounts, code, or data with production systems.
• Whether files were actually uploaded or passwords actually changed.
• Whether the system is still exposed.
• Whether the institution is aware.

Recommended Actions for the Institution

1. 1.Take the test system offline immediately, and check whether production systems expose the same API.
2. 2.Require authentication and authorization on every API query and action, and limit how many records a single request can return.
3. 3.Check the server for files uploaded through the upload function, especially executable files, and remove any found.
4. 4.Review whether any passwords were changed or records deleted through the unauthenticated actions, and restore from backups if so.
5. 5.Preserve logs before remediation, including web application firewall and API logs.
6. 6.Stop using real personal data in test systems. Use synthetic or masked data instead.
7. 7.Notify the National Privacy Commission and affected applicants within 72 hours under NPC Circular 16-03 if there is reasonable belief the data was exposed.
8. 8.Request takedown of the download link and forum post, after preserving evidence.
9. 9.Warn applicants and parents about phishing and fraud using their details.
10. 10.Issue a public advisory. The contrast example on this site is the NEUST advisory on its exposed admission records.

How to Prevent This Pattern

1. 1.Never put real personal data in test or staging systems.
2. 2.Disable GraphQL introspection and enforce authorization at the resolver level, not only at the front end.
3. 3.Cap page sizes and rate-limit API queries that return personal data.
4. 4.Restrict upload functions to authenticated users, fixed folders, and safe file types.
5. 5.Do not rely on a web application firewall alone; it is not a substitute for access control.
6. 6.Publish a security contact for private vulnerability reports.