Single-source notice: This incident is based on a single public Facebook post, reviewed via screenshots provided to this site. No mainstream news outlet has reported it, no independent researcher has corroborated it, and the university has not issued a public statement. The claim remains unverified and the university's name has been redacted pending verification.
The screenshots publish the names, dates of birth, control numbers, and entrance-exam results of identifiable college applicants, many of them minors. None of that information, and no identifier drawn from it, is reproduced on this site.
What Happened
On November 6, 2026, a Facebook account using the name Br4in r00t posted a single profane line in Tagalog addressed to an unnamed "sir" and tagging the official page of a state university in Bicol Region. The post carried two screenshots of a spreadsheet titled with the name of the university's online registration and enrollment system. It gave no explanation of how the data was obtained, claimed no record count, and made no demands.
What the Screenshots Show
The spreadsheet appears to be an export of 2026 college admission applicants. The two screenshots together show roughly 80 rows, with the following columns:
- Entrance-exam control numbers, each with a date and time stamp in March to May 2026
- Applicant numbers and full names, with the applicant number built from the year, the college applied to, and a random code
- Dates of birth, almost all between 2006 and 2009
- Entrance-exam results: a raw score, a rating, and a percentile rank
- First, second, and third choices of degree program
- A status code for each application
The screenshots show only part of the sheet, so the total number of rows is not known.
Why the Methodology Treats This as 'Unconfirmed'
- The only public source is the threat actor's own Facebook post
- No corroborating media coverage has been observed
- No NPC finding is available
- No public statement has been issued by the university
- The post does not say how the data was obtained, so it is not known whether this reflects a system compromise, an exposed file, or data shared by someone with legitimate access
If the university issues a statement, if reputable Philippine media reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.
Threat-Actor Persona and Cross-References
The handle Br4in r00t also signed, as BR4IN R00T together with ST4X, the defacement of a Metro Manila public high school's e-learning site, posted the same day by Nullsec Philippines. That places this post within the Nullsec Philippines network. This post was made from what appears to be the persona's own account rather than the Nullsec page.
The post does not use the #MMM2026 hashtag, but it was made the day after the November 5 Million Mask March, when several other claims against Philippine schools were posted. See The #MMM2026 Wave for that context.
Why This Claim Warrants Attention
- The data is already public. Unlike claims that hold data back, this post published identifiable applicants' details directly on Facebook.
- Many applicants are minors. Birthdates between 2006 and 2009 mean many applicants were under 18 when they applied.
- Applicant data supports targeted scams. Names, birthdates, exam results, and program choices allow convincing fake messages about admission results, scholarships, or enrollment fees.
- Admission systems are a recurring weak point. The confirmed NEUST exposure the same week also involved college admission records.
What Is Not Known
- How the data was obtained.
- How many applicants are in the full export.
- Whether other data, such as contact details, addresses, or uploaded documents, was also taken.
- Whether the system is still exposed.
- Whether the university is aware.
Recommended Actions for the University
- 1.Treat the published data as a confirmed exposure of the applicants shown, regardless of how it was obtained.
- 2.Find the source. Check the registration and enrollment system, its exports, shared drives, and staff accounts for how the spreadsheet left the university.
- 3.Preserve logs before changing anything.
- 4.Secure the system: reset administrator and staff passwords, review who can export applicant data, and patch or restrict the application.
- 5.Notify the National Privacy Commission within 72 hours under RA 10173, and notify the affected applicants and their parents. Published personal data of minors is well inside the threshold.
- 6.Request removal of the post from the platform as publishing personal data of identifiable individuals, after preserving a copy.
- 7.Warn applicants and parents about fake messages that quote real exam results or program choices.
- 8.Issue a public advisory. The contrast example on this site is the Assumption College of Davao ICTC advisory.
How to Prevent This Pattern
- 1.Limit who can export applicant data, and log every export.
- 2.Keep admission systems behind authentication and off the public internet where possible.
- 3.Delete or archive applicant records once the admission cycle ends.
- 4.Use unique passwords and multi-factor authentication for staff accounts on admission systems.
- 5.Publish a security contact so finders can report flaws privately.