University of Camarines Norte (UCN)

Update — school named, status 'investigating': This entry was first published anonymized as "a university in Bicol Region" and tagged 'unconfirmed'. On November 11, 2026, OneNews.PH, citing an intelligence assessment by Deep Web Konek, named the University of Camarines Norte among the educational institutions in the assessment. Under the SchoolBreach.org methodology, a school named in mainstream media coverage is named here. The claim itself remains unverified: UCN has not issued a public statement, and the NPC has not published a finding.

The post includes a public download link presented as the full dataset, along with attachments that show identification photographs of students. This site has not opened the link. The link, the hosting service's path, and every image, filename and record value from the attachments are withheld, in line with the methodology of refusing to amplify breach material.

Related Incident

This post follows an earlier claim by the same page and persona. On August 1, 2026, CrimsonSec Philippines claimed it had found and exploited a vulnerability in UCN's student information and accounting portal. That post said nothing had been copied or sold. That incident is documented separately: UCN student portal access claim.

The two entries are kept separate because they describe different events. The August entry covers the claimed access. This entry covers the claimed public release of data, more than three months later. Nothing in the November post claims a new intrusion. It describes its data as the result of the earlier "security assessment" of the institution's student portals, so the most likely reading is that the dataset comes from the access claimed in August.

What Happened

On November 5, 2026, the Facebook page CrimsonSec Philippines published a long post, opening with the signature line Ph.0xUnknown404, that names the University of Camarines Norte (UCN). The post describes the actor's earlier activity as a "security assessment" of the institution's student portals and says it found serious security problems.

The post claims the actor accessed names, addresses, phone numbers, student records, family information, and account credentials. It gives specific counts: 39,620 student records and 18,645 student accounts with cracked passwords. It addresses students, the administration, and the public, and calls on the administration to fix the problems and be honest with students.

The post is framed around November 5 and the hashtags #MMM and #MMM2026, which refer to the annual November 5 mask-themed protest day. It also carries the hashtag #DeepWebKonek. It closes with a download link on a consumer file-sharing service and a greetz line.

What the Post Claims and Shows

• A public download link. The post presents the link as the dataset itself. This is the main change from the August post, which said nothing had been copied or sold. If the link resolves to what the post describes, the data is being distributed to anyone who reads the post. This site has not opened the link, and it is not reproduced here.
• A grid of student identification photographs. The attachment shows several dozen portraits in the standard school-ID format, each under a randomized alphanumeric filename, with the grid continuing beyond the visible frame. No image or filename is reproduced here.
• A dark-web forum listing. A second attachment is a screenshot of a forum thread titled with the institution's name followed by "Database philippines 2026." It was posted by a forum account under a separate handle that shows a single post, a single thread, and a join date in October 2026. The listing's timestamp reads "Yesterday," which is consistent with about November 4, 2026. The listing describes the dataset by its table and field structure:
• Student tables. A primary student table of 39 fields, including name, password, personal email, mobile and landline numbers, a social-media profile field, current and home addresses, parents' names, educational attainment, occupations, employers and mobile numbers, date and place of birth, nationality, citizenship, religion, civil status, sex, height, weight, blood type, bank and account-number fields, an entrance-exam score, and an NSTP serial number.
• Extended and credential tables. A 42-field student master table that adds photo filenames, cracked passwords, and parent-account passwords, along with smaller tables named for student names and passwords, cracked student credentials, and cracked credentials generally.
• Staff tables. An employee table with address, telephone, department, and rank fields, and a staff-user table of 11 fields that includes password, security-question, and security-answer fields, plus a queue-system user table.
• Academic and financial tables. Course, subject, class, enrollment (20 fields), grade, and grade-detail tables, and student ledger and ledger-detail tables covering document types, amounts, assessments, deferments, and cancellations.

Update — November 11, 2026: Media Report

On November 11, 2026, OneNews.PH reported on an intelligence assessment by the monitoring group Deep Web Konek covering underground disclosures from November 5 to 7, 2026. The assessment lists 23 Philippine institutions, among them government agencies and four educational institutions. According to the report, CrimsonSec Philippines and another group called GWAPINGS123 accessed UCN's "full academic and financial database." The report gives no record count or date for UCN, and does not say whether the data was independently checked.

GWAPINGS123 does not appear in the November 5 post or its greetz line, and has not previously appeared on this site. The report does not say what role it played.

Why the Methodology Treats This as 'Investigating'

This entry names the institution and is tagged 'Investigating' because:

• OneNews.PH, citing Deep Web Konek's assessment, named the University of Camarines Norte and reported that CrimsonSec Philippines accessed its academic and financial database
• The claim has therefore been reported by mainstream media beyond the threat actor's own post

It is not 'confirmed' because:

• OneNews.PH reports what Deep Web Konek's assessment says; neither says the dataset was verified
• The forum listing is shown inside the actor's own post. It is treated as the actor's artifact, not as independent corroboration
• No public statement has been issued by UCN
• No NPC finding is available

If UCN issues a statement or the NPC publishes a finding, this entry will be updated in line with the SchoolBreach.org methodology.

Threat-Actor Persona and Cross-References

The post comes from the same page and persona as the August 1, 2026 student portal access claim against UCN. CrimsonSec Philippines and Ph.0xUnknown404 are also behind the Laguna private-university breach-and-defacement claim (August 11, 2026).

The greetz line names lu²3verd4y, Ph BLAKE, bithub, D3SKUPAL, Ph synx4, and TIT3123:

• Ph BLAKE corresponds to Ph.Bl4ke, the persona behind the Storm Breaker Security PH claims and the Cebu City WordPress-credential claim.
• bithub and Ph synx4 (Ph.Synx4) appeared with Ph.0xUnknown404 in that Cebu post's special-greetings line and in the Laguna claim's defacement page.
• lu²3verd4y, D3SKUPAL, and TIT3123 have not previously appeared on this site.

The overlap keeps this post inside the extended-collective network documented elsewhere on this site. A post from within that network does not count as independent corroboration of another post from it.

Why This Claim Warrants Attention

• The described dataset is a full identity set that includes minors. Name, photograph, address, contact numbers, date and place of birth, and parent details together support identity fraud and targeted social engineering against families. Many records in a university student system belong to people who were minors when they enrolled.
• A public download link changes the exposure. A claimed access affects one actor. A claimed public release puts the same data in front of anyone who reads the post, and copies cannot be recalled once downloaded.
• Cracked passwords extend the risk past the institution. Students and parents who reused a portal password elsewhere are exposed on those other accounts, whatever the institution does to its own system.
• Staff security answers enable account takeover. Security-question answers are often reused as recovery answers on email and banking accounts, so they can be used to take over accounts beyond the portal.
• Bank and ledger fields raise financial-fraud risk. Bank-account fields and tuition ledger records support convincing payment-fraud messages to students and parents.

What Is Not Known

• Whether the download link contains what the post describes. This site has not opened it, and no independent party has reported on its contents.
• Whether the forum account is the same actor. The listing appeared about a day before the Facebook post, under a different handle. It may be the same actor, an affiliate, or an outside seller.
• Whether this dataset comes from the August access. The post implies it, but does not say when the data was taken or whether access continued after August 1.
• How the passwords were cracked. The counts imply weak or legacy password storage, but no evidence of the storage scheme is given.
• What GWAPINGS123 did. The OneNews.PH report names a second group alongside CrimsonSec Philippines but does not describe its role.
• Whether the institution is aware. No public statement, advisory, or reply has been observed as of this entry.

Recommended Actions for the Institution

The portal-level actions in the August entry still apply. The actions below address the claimed public release.

1. 1.Assume the dataset is public until it is shown not to be. Plan the response on the basis that every category in the forum listing is in circulation.
2. 2.Force a password reset for every student, parent, and staff account, and invalidate all sessions. Replace staff security questions with a stronger recovery method, since the listing describes their answers as included.
3. 3.Notify the National Privacy Commission within 72 hours under RA 10173. The claimed public release of minors' identity data, parents' contact data, credentials, and bank-account fields is well inside the notification threshold. If an NPC notification was made after the August claim, update it to cover the claimed release.
4. 4.Notify affected students, parents, and staff directly. Tell them what is claimed and what to do: change any password reused from the portal, change any reused security answers, and treat unexpected tuition-payment or bank-related messages as likely fraud.
5. 5.Issue a same-day public advisory. Silence in the face of a public claim leaves the threat actor's framing as the only public narrative. The contrast example on this site is the Assumption College of Davao ICTC advisory, issued the same day as that claim.
6. 6.Request takedown of the post, the forum listing, and the file-sharing link. Report them to the platforms as publishing identifiable personal data, including images of individuals. Preserve archived copies for the NPC filing or a law-enforcement referral before doing so.
7. 7.Verify the dataset against institutional records. If a copy is obtained through proper channels, compare its tables and counts with production systems to confirm or rule out the claim and to identify the snapshot date.
8. 8.Confirm the original access path is closed. If the August vulnerability has not been found and fixed, the data may still be reachable, and the release may not be the last.
9. 9.Refer the incident to law enforcement. The PNP Anti-Cybercrime Group and the NBI Cybercrime Division handle data-leak and distribution cases.
10. 10.Set up a single point of contact for affected students, parents, and staff, separate from the registrar and enrollment channels.

How to Prevent This Pattern

1. 1.Treat a public access claim as a countdown to a release. In this case, as in other follow-up claims on this site, a public access claim was followed by a data release. The time between them is the window to fix the flaw and warn affected people.
2. 2.Store passwords with a current memory-hard hashing algorithm and per-user salts. Weak storage is what turns a database copy into thousands of usable passwords.
3. 3.Do not use security questions for account recovery. Their answers are static, guessable, and often reused across services.
4. 4.Collect only the data the institution needs. Bank-account, blood-type, and body-measurement fields stored in the main student table widen the impact of any breach.
5. 5.Apply retention limits and archive graduated cohorts out of the live system. A live portal holding every record ever created makes a single breach far larger.
6. 6.Pre-stage a breach notification and advisory template so a same-day response is possible.
7. 7.Publish a security contact and responsible-disclosure policy. A monitored private channel gives finders somewhere to report a flaw other than a public page.