A state university in Eastern Visayas

Single-source notice: This incident is based on a single public Facebook post by a self-identified actor, reviewed via a screenshot provided to this site. No mainstream news outlet has reported on it, no independent researcher has corroborated it, and the institution has not issued a public statement. The claim remains unverified and the institution's name has been redacted pending verification.

The actor's contact email address and the administrator URLs shown in the screenshots are not reproduced on this site.

What Happened

On or about November 8, 2026 (the post shows as four days old in a screenshot taken November 12), the Facebook page Liwat published a post addressed to a state university in Eastern Visayas and tagging one of its campuses. Writing in Filipino and Waray, the post says it is a message to the university because a "hacktivist/greyhat" had published claims about another state university in the region, which, the post says, ignored Liwat. It asks the university not to ignore the message, gives an email address to contact "by this evening," and is signed "#Whitehat Cybersecurity - Liwat." It links to the university's "About" page.

What the Screenshots Show

• Altered public content. The main screenshot shows the footer of the university's live "About" page. Under "About the University," where a link would normally appear, the text reads "liwat itun HAHAH" (roughly "that's Liwat, haha" in Waray).
• Content-management administrator access. Three smaller screenshots, partly blurred in the post, appear to show the site's content-management system: an article-editing screen whose address is in the system's administrator area, an article list including an item titled with a greeting from Liwat to the university, and a system messages page.

Taken together, the screenshots suggest the actor could log in to the website's content-management system with editing rights and used that access to change public content. The post does not say how the access was obtained.

Why the Methodology Treats This as 'Unconfirmed'

This entry is fully anonymized and tagged as 'Unconfirmed' because:

• The only public source is the actor's own Facebook post
• No corroborating media coverage has been observed
• No NPC finding is available
• No public statement has been issued by the institution

If the institution issues a statement, if reputable Philippine media independently reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

Liwat calls itself a white-hat and says it wants to test the security of websites in Region 8. In a later post it says it left a "greyhat/hacktivist" group after that group published claims against another state university in the region, which is tracked as a separate, named entry on this site. That university's November 11 statement credits a white-hat hacker known as "Liwat" with helping mitigate an incident.

Liwat's school posts follow a pattern: public evidence of access, a request that the institution make contact, and in some cases pressure to acknowledge the disclosure publicly. Related entries:

• A private college in Eastern Visayas, website content injection (November 4, 2026)
• A state university in Eastern Visayas, student portal access claim (November 12, 2026)

Changing a live public website to prove access goes beyond what responsible-disclosure norms allow, whatever the stated intent.

Why This Claim Warrants Attention

• Editing rights on the main website are enough for serious harm. The same access could publish fake announcements, phishing links or malicious scripts on the university's most trusted domain.
• The administrator area appears to be reachable from the internet. If it is, it is exposed to password guessing and known exploits for the content-management system.
• The access method is unknown. If a password was reused or leaked, other university systems may share it.

What Is Not Known

• How the actor got administrator or editor access: a weak or reused password, a stolen session, or a software vulnerability.
• Whether other changes were made, including hidden scripts, new user accounts or uploaded files.
• Whether the university has since contacted the actor or fixed the weakness.

Recommended Actions for the Institution

1. 1.Audit content-management user accounts. Remove unknown accounts, reset all passwords and end all active sessions.
2. 2.Restore altered content from a known-good backup and compare site files against the original to find hidden changes.
3. 3.Update the content-management system and its extensions to current, supported versions.
4. 4.Restrict the administrator area to campus or VPN addresses and require multi-factor authentication.
5. 5.Preserve server and application logs before cleanup to establish how access was obtained.
6. 6.Check whether the website shares credentials or hosting with other systems, such as student portals.
7. 7.Engage through official channels. If the institution chooses to talk to the actor, it should do so through its data protection officer and keep a record.

How to Prevent This Pattern

1. 1.Never leave a content-management administrator page open to the whole internet.
2. 2.Require multi-factor authentication for every editor and administrator.
3. 3.Patch the content-management system and extensions on a schedule.
4. 4.Monitor public pages for unexpected changes and alert on them.
5. 5.Publish a security contact and responsible-disclosure policy that routes reports straight to the IT office, so finders do not need to post publicly.