A state university in Northern Luzon

Single-source notice: This incident is based on a single public Facebook post by a self-identified threat actor, reviewed via a screenshot provided to this site. No mainstream news outlet has reported on it, no independent researcher has corroborated it, and the institution has not issued a public statement. The claim remains unverified and the institution's name has been redacted pending verification.

This site did not open, download, or archive the linked file or video. The encoded links, the file-sharing URL, and the filename are not reproduced here.

What Happened

On or about November 11, 2026 (the screenshot shows the post as "21h" old), the Facebook page QuantumSec Group, which uses a "Quantum Security Group" logo, published a public post greeting a state university in Northern Luzon and tagging the registrar's office of one of its campuses.

Most of the post is a grievance rather than a breach claim. It says it wants to "raise concern regarding the experiences of students" across the university's campuses, especially "the treatment of students by some professors" and "the academic pressure and treatment experienced by Engineering students" at a second campus. It calls for the concerns to be "heard, taken seriously, and addressed by the appropriate university authorities," and ends: "Education should challenge students to grow, not make them feel dehumanized."

The post then says "Decode it Into Base64" and gives two base64-encoded strings:

• "Data", which decodes to a link to a CSV file on a public file-sharing service. The filename names the campus whose registrar's office the post tagged.
• "Video", which decodes to a link on an anonymous video-hosting site.

The post is signed "- Kr0vm4k" and includes the university's seal as an image.

What the Post Claims

The post never says in words that the university was hacked. The claim is implied by attaching a "Data" file named after a campus and addressing the post to that campus's registrar's office. In practice:

• No record count is given
• No data types are listed
• No access method is described
• No screenshots of systems, databases, or records appear in the post's visible content
• The video's content is not described

Because this site did not open the links, it cannot say whether the CSV holds student records, what fields it contains, how many rows it has, or whether it is genuine. The tagging of the registrar's office suggests the file is meant to be read as registrar data, such as enrollment or student records, but that is an inference, not a claim the post makes.

Why the Methodology Treats This as 'Unconfirmed'

This entry is fully anonymized and tagged as 'Unconfirmed' because:

• The only public source is the threat actor's own Facebook post
• No corroborating report from Deep Web Konek, mainstream media, or an independent researcher has been observed
• No NPC finding is available
• No public statement has been issued by the institution
• The post does not describe the data at all, and its contents have not been verified

If the institution issues a statement, if reputable Philippine media or Deep Web Konek independently reports the incident, or if the NPC publishes a finding, this entry will be updated and de-anonymized in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

The publishing page uses the Quantum Security Group name and logo. Quantum Security Group (QSG) has been documented on this site since May 2026, including the private IT-focused university chain student-records claim (May 27, 2026, signed "#ch4nc3ll0rx_1337") and the private medical college in Cebu City defacement and exfiltration claim (May–June 2026, signed "ZeuS" and later "QSG Team"). QSG has appeared in Nullsec Philippines greetz lines and is treated on this site as part of the Nullsec extended-collective network.

The signing handle Kr0vm4k has not appeared in any earlier entry on this site. Whether it is a new member, an alias of a known persona, or a separate actor using the QSG name cannot be determined from the post. The page name in the screenshot ("QuantumSec Group") is also slightly different from the "Quantum Security Group" name used in earlier posts.

This post differs from QSG's earlier school claims in two ways: it uses a student-welfare grievance rather than a security-shaming framing, and it gives no technical detail at all.

Why This Claim Warrants Attention

• Registrar files hold the most sensitive student data a university keeps. If the CSV is a genuine registrar export, it may include names, student numbers, addresses, birth dates, contact details, and academic standing.
• The file is publicly downloadable. Anyone who decodes the base64 string can retrieve it, so exposure is not limited to the actor.
• Base64 encoding is used to avoid link filters. It keeps the links from being removed automatically by the platform, so the file is likely to stay reachable unless the host takes it down.
• The grievance framing may draw wide sharing among students, which spreads the encoded links along with it.
• QSG has escalated before. In the Cebu City case, an initial post was followed weeks later by a larger exfiltration claim.

What Is Not Known

• Whether the CSV is genuine, and whether it came from the university's systems at all.
• What the file contains: fields, number of records, and the time period covered.
• How the data was obtained: a system compromise, an exposed export, or an insider.
• What the video shows, and whether it relates to the data or to the grievance.
• Who Kr0vm4k is and how they relate to the QSG personas documented earlier.
• Whether the file and video are still online.

Recommended Actions for the Institution

1. 1.Retrieve and assess the linked file in a controlled way. Have the IT and data protection offices determine whether it matches registrar records, which system it came from, and how many people it covers.
2. 2.Request takedown of the file and video from both hosting services and report the post to the platform, after preserving copies for the investigation.
3. 3.Identify the source system. Check registrar, enrollment, and student-information systems for unauthorized exports, exposed reports, or shared-drive files matching the filename.
4. 4.Preserve logs before remediation. Copy web server, application, database, and file-share logs to isolated storage, covering at least the last 90 days.
5. 5.Review accounts with export rights on registrar systems, rotate their credentials, and enforce multi-factor authentication.
6. 6.Notify the National Privacy Commission within 72 hours under RA 10173 once there is a real risk that personal data was exposed. The trigger is a reasonable belief of a breach, not certainty.
7. 7.Issue a same-day public advisory to students and staff explaining what is known and warning them against phishing that may use their records. Silence in the face of a public claim leaves the threat actor's framing as the only public narrative. The contrast example on this site is the Assumption College of Davao ICTC advisory, issued the same day as that claim.
8. 8.Respond to the student-welfare concerns through normal channels. The grievance is separate from the security incident, and addressing it openly reduces the actor's leverage.
9. 9.Notify affected students directly if the file is confirmed to contain their data.

How to Prevent This Pattern

1. 1.Limit bulk exports from registrar systems to named roles, and log every export.
2. 2.Do not keep student-record exports on shared drives or public links. Exported files are a common source of leaks.
3. 3.Use multi-factor authentication for every account that can read or export student records.
4. 4.Watch for the institution's name and domain on file-sharing services and in local threat-actor pages.
5. 5.Give students a trusted, safe channel for complaints, so grievances are less likely to be raised through threat actors.
6. 6.Publish a security contact and responsible-disclosure policy that routes reports straight to the IT office.
7. 7.Rehearse an incident response plan that includes the NPC 72-hour notice and a same-day advisory template.