University of the Philippines Cebu (UP Cebu)

What Happened

On June 7, 2020, a document appeared on Scribd.com containing the names and temporary login passwords of students and alumni from UP Cebu's College of Communication, Art, and Design (CCAD). These credentials were for the Student Evaluation on Teaching (SET) system — a locally hosted web portal used by students to rate professors at the end of each semester. The SET system was taken offline that same Sunday morning. UP Cebu publicly confirmed the breach on June 8, 2020.

What Was Exposed

Only student names and SAIS (Student Academic Information System) IDs used as SET login credentials were leaked. Chancellor Liza D. Corro stated that "apart from the students' names and SAIS IDs, no other personal or sensitive personal information of students can be found even if the passwords were correct" and that "all other relevant data in the said evaluation system are encrypted." The SET system was separate from and not connected to SAIS, which handles academic and financial records for all UP students system-wide.

Investigation

Data Protection Officer Van Owen M. Sesaldo conducted a technical check of the server and network equipment, reporting to Chancellor Corro on June 9, 2020 that "there were no indications of compromise, implying that no unauthorized access occurred." Atty. Marcia Ruth Gabriela Fernandez, the UP System DPO, confirmed with the UP Information Technology Development Center (ITDC) that SAIS was not breached. She formally notified National Privacy Commissioner Raymund E. Liboro by letter dated June 10, 2020.

The UP System's official conclusion, published June 12, 2020, was: "No personal and technical data breach happened." How the credentials ended up on Scribd was never publicly explained, and no group claimed responsibility.

Connection to Fake Facebook Account Campaign

The SET leak occurred amid a politically charged sequence of events:

• June 5, 2020: Eight people were arrested during an anti-terrorism bill protest at the UP Cebu campus, including students Joahanna Veloso (YANAT Cebu), Bern Canedo (student council VP), and Nar Porlas (Anakbayan UP Cebu).
• June 6, 2020: Tug-ani, UP Cebu's student newspaper, first reported the emergence of fake/dummy Facebook accounts bearing students' names.
• June 7, 2020: The fake accounts multiplied rapidly — Canedo and Porlas each had at least 30 duplicates. Within hours, student organizations tracked nearly 500 fake accounts cloned from 115 individuals. The phenomenon spread to other UP campuses and then to other universities (DLSU, UST, USC, etc.). Even Chancellor Corro was targeted.

The fake accounts were used to send threats, accuse real users of being communist sympathizers, and sign petitions the real owners did not support. The National Computer Emergency Response Team determined the accounts could not have been created manually and likely involved automated software. The connection between the SET credential leak and the fake account campaign was never definitively established, though the timing was widely noted.

In September 2020, Facebook took down 57 accounts, 31 pages, and 20 Instagram accounts linked to Philippine military and police as part of a broader coordinated inauthentic behavior takedown.

Remedial Measures

As a precaution, the UP System began requiring usernames and passwords to access UPCAT (admissions test) results, which had previously been accessible without authentication. The leaked SET credentials were scheduled for replacement in the next evaluation period.

How to Prevent This

1. 1.Isolate evaluation systems from primary credentials — avoid reusing SAIS or main system credentials for ancillary platforms like SET
2. 2.Implement proper access controls — ensure evaluation documents and credential lists are never publicly accessible
3. 3.Use unique, hashed credentials — avoid distributing temporary passwords in plaintext or via third-party platforms
4. 4.Conduct security audits of ancillary systems — smaller, locally-managed platforms often receive less security attention
5. 5.Enable monitoring and alerting — detect unauthorized access to sensitive documents promptly