A state university in Eastern Visayas

Single-source notice: This incident is based on a single public Facebook post by a self-identified actor, reviewed via a screenshot provided to this site. No mainstream news outlet has reported on it, no independent researcher has corroborated it, and the institution has not issued a public statement. The claim remains unverified and the institution's name has been redacted pending verification.

What Happened

On November 12, 2026, the Facebook page Liwat published a post addressed to a state university in Eastern Visayas, tagging the university's page. The post reads: "The Goal was never access. it was resilience for a stronger and safest for your system data... I will not tell here what Vulnerability you have, just direct message me and i will coordinate." It continues in Filipino, asking the university not to take long "so I won't have to post the sensitive file," and is signed "-Liwat Cybersecurity | Whitehat."

What the Screenshots Show

• A logged-in student portal. One screenshot shows a student dashboard with an academic summary: units for the semester, semesters enrolled, a previous-semester grade-point average, and the update status of the student's personal information, educational background and family background records. No name or student number is visible in the cropped image.
• The university's journal-publishing site. A second screenshot shows the home page of the university's academic journal site.

Both browser windows show bookmarks for offensive-security resources. The screenshots show that the actor could view one student's portal account. They do not show how the account was accessed, whether other accounts were reachable, or what the "sensitive file" is.

Why the Methodology Treats This as 'Unconfirmed'

This entry is fully anonymized and tagged as 'Unconfirmed' because:

• The only public source is the actor's own Facebook post
• No corroborating media coverage has been observed
• No NPC finding is available
• No public statement has been issued by the institution
• The post withholds the vulnerability and does not describe the "sensitive file"

If the institution issues a statement, if reputable Philippine media independently reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

Liwat calls itself a white-hat focused on Region 8. Its recent school posts follow a consistent pattern: public evidence of access, an offer to disclose privately, and pressure to respond quickly or to acknowledge the disclosure publicly. Related entries:

• A private college in Eastern Visayas, website content injection (November 4, 2026)
• A state university in Eastern Visayas, CMS content tampering (November 8, 2026)
• The EVSU HRMIS entry, whose November 11 university statement credits a white-hat hacker known as "Liwat" with helping mitigate an incident

The line about posting a "sensitive file" if the university is slow to respond is a conditional threat to publish data. That is not consistent with responsible-disclosure practice, whatever the stated intent.

Why This Claim Warrants Attention

• Student portals hold personal and family records. The dashboard shows personal information, educational background and family background sections, which typically include addresses, contact details, parents' names and income.
• A threat to publish has been made. The post links publication of a "sensitive file" to how quickly the university responds.
• The vulnerability has not been disclosed. Until the university learns what it is, others may find and exploit it too.

What Is Not Known

• How the portal was accessed: a broken access control, a leaked or guessed password, or another flaw.
• How many accounts are affected, and whether records were copied.
• What the "sensitive file" contains.
• Whether the journal site is part of the same weakness or was included only to show the institution.

Recommended Actions for the Institution

1. 1.Assume student portal records may be exposed until the review shows otherwise.
2. 2.Review portal access controls, especially whether one logged-in user can view another user's records by changing an ID in a request.
3. 3.Reset credentials and end sessions for any account that may be affected, and check for default or shared passwords.
4. 4.Preserve portal, web server and authentication logs to identify how and when access occurred.
5. 5.Review the journal site and any other public applications on the same domain for known vulnerabilities.
6. 6.Respond through the data protection officer. If the institution engages the actor, it should do so formally and keep records, and should not pay or make concessions under threat.
7. 7.Notify the National Privacy Commission within 72 hours under RA 10173 if there is a real risk that personal data was accessed.
8. 8.Issue a same-day public advisory. Silence in the face of a public claim leaves the actor's framing as the only public narrative. The contrast example on this site is the Assumption College of Davao ICTC advisory.

How to Prevent This Pattern

1. 1.Check authorization on every request, not only at login, so users can only see their own records.
2. 2.Require multi-factor authentication for staff and administrator portal accounts.
3. 3.Keep third-party platforms such as journal systems patched.
4. 4.Run regular access-control tests on student-facing applications.
5. 5.Publish a security contact and responsible-disclosure policy with a named response time, so researchers have no reason to use public pressure.