Romblon State University (RSU)

What Happened

In April 2025, a hacktivist group calling itself "DeathNote Hacker Philippines" breached the website of Romblon State University (RSU) in Odiongan, Romblon. The group claimed to have stolen the personal information of both students and faculty members.

RSU's management convened to assess the extent of the damage. RSU spokesperson Sherryll Sweetah Fetalvero confirmed the incident through online statements.

Motive

The attackers stated they were motivated by:

• Alleged misconduct by faculty members
• Frustration over unchanged class schedules despite extreme heat conditions

This positions the attack as hacktivism — using cyberattacks to draw attention to grievances rather than for financial gain.

What Was Compromised

The group claimed to have stolen:

• Student personal information — names, contact details, and potentially academic records
• Faculty personal information — staff details and employment records
• Internal school records — the full extent of exfiltrated data is still being assessed

Response

The Department of Science and Technology (DOST) Romblon director Marcelina Servañez confirmed the cyberattack, stating that RSU "is capable of addressing the situation with little help from outside parties."

RSU issued an official statement on their Facebook page acknowledging the data breach incident.

Why This Breach Matters

• Hacktivist targeting of universities — Philippine hacktivist groups like DeathNote Hacker Philippines are part of a growing trend of cyber activists targeting educational institutions
• Grievance-driven attacks — even seemingly minor institutional complaints (like class schedules) can motivate threat actors to breach systems and expose personal data
• Data of students at risk — regardless of the attacker's stated motive, the personal information of students and faculty is now potentially compromised
• Regional universities are targets too — not just Manila-based institutions; schools in provincial areas like Romblon are equally at risk

Lessons for Schools

1. 1.Any grievance can become a motive — schools should not assume they are too small or too remote to be targeted
2. 2.Website security is critical — web applications are the most common entry point for attacks
3. 3.Incident response planning — RSU's prompt assessment shows the value of having a response plan in place
4. 4.NPC notification — if personal data was confirmed compromised, the school must notify the NPC within 72 hours under the Data Privacy Act