University of the Philippines Visayas (UPV)

What Happened

On June 11, 2020, the University of the Philippines Visayas (UPV) confirmed that its official website (upv.edu.ph) was defaced. In a Facebook post, the university stated: "We have temporarily taken down our webserver after receiving and verifying the information that there was a defacement of the UPV website."

The defacement was part of a broader wave of attacks targeting Philippine educational institutions during June 2020, as schools transitioned to online learning during the COVID-19 pandemic.

Response

UPV's technical team conducted a security audit and implemented steps to prevent further incidents. The university temporarily took down its web server while the investigation and remediation were underway.

Broader Context

UPV was one of over 20 Philippine schools hacked in June 2020 alone. The wave of attacks coincided with the shift to online education during the pandemic, exposing widespread security weaknesses across Philippine educational institutions.

How to Prevent This

1. 1.Keep web server software updated — ensure CMS platforms, plugins, and server software are patched against known vulnerabilities
2. 2.Implement a Web Application Firewall (WAF) — to block common defacement techniques like SQL injection and cross-site scripting
3. 3.Use file integrity monitoring — tools that alert when website files are modified unexpectedly
4. 4.Restrict admin access — use strong passwords, MFA, and IP whitelisting for administrative panels
5. 5.Maintain regular backups — so defaced sites can be quickly restored while the root cause is investigated