University of St. La Salle (USLS)

Update — school named: This entry was first published anonymized as "a private Catholic university in the Visayas." On November 10 and 11, 2026, Unbox PH and OneNews.PH, both citing a summary by Deep Web Konek (DWK), named the University of St. La Salle among the institutions allegedly affected from November 5 to 7. Under the SchoolBreach.org methodology, a school named in mainstream media coverage is named here. The entry stays 'investigating': USLS has not issued a public statement, and the NPC has not published a finding.

The post also makes allegations about the personal conduct of an individual faculty member, identified by a nickname. Those allegations are unverified, are unrelated to the data-security claim, and concern a private individual. They are not repeated or summarized on this site beyond this note.

What Happened

On November 6, 2026, at 12:32 PM according to the forum's timestamp, a user under the alias pocherowithpetchay opened a thread on a dark-web forum titled with the name of the University of St. La Salle (USLS). The post says that in the course of an "ongoing audit," the author found the university had neglected the security of its students, and that the personal information of more than 11,000 students had been exposed. It lists full names, home addresses, contact numbers, birthdates, parents' names and contact numbers, academic records, medical records, class schedules, and tuition balances, and says the university "left your data wide open for anyone to take." It contrasts the claimed exposure with the institution's academic reputation.

Most of the remaining text is a Million Mask March manifesto. It opens by acknowledging the post is "a day late" because November 5 has passed, and closes with "Happy November 6. Happy Million Mask March. Wake up. Speak up. Stand up. MMM2026." Below the post is a hidden-content block that the forum reveals only to readers who reply to the thread, a mechanism commonly used on such forums to gate a sample or download link.

Deep Web Konek then published a summary of the post under #MMM2026, listing the claimed data categories and noting the separate allegations about a faculty member.

What the Post Claims and Shows

• A record count. More than 11,000 student records. No breakdown by year, campus, or table is given.
• Data categories. Names, home addresses, contact numbers, birthdates, parents' names and contact numbers, academic records, medical records, class schedules, and tuition balances.
• How the data was reached. The post names no system, URL, or method.
• No sample in the screenshot. The visible post contains no records. The hidden-content block may hold a sample or link, but its contents are not visible.
• The forum account. The pocherowithpetchay account shows the forum's "Pwned" rank, a join date of November 2026, 3 posts, 1 thread, and a reputation of zero.

Update — November 10–11, 2026: Media Reports

On November 10, 2026, Unbox PH reported on Deep Web Konek's summary of 23 organizations allegedly hacked from November 5 to 7, put at over 600GB of data in total, and listed the University of St. La Salle among the institutions allegedly affected. It gives no details for USLS, and says nothing in the summary had been confirmed beyond two government agencies' own notices.

On November 11, 2026, OneNews.PH reported on an intelligence assessment by Deep Web Konek covering underground disclosures from November 5 to 7, 2026, which lists 23 Philippine institutions, among them four educational institutions. According to the report, more than 11,000 student profiles at USLS were accessed by the group pocherowithpetchay. The report gives no further detail on the data and does not say whether it was independently checked. It does not repeat the allegations about a faculty member.

Why the Methodology Treats This as 'Investigating'

This entry names the institution and is tagged 'Investigating' because Deep Web Konek reported the claim and OneNews.PH then named USLS in mainstream coverage, after Unbox PH listed it the day before. It is not 'confirmed' because:

• DWK's report and the Unbox PH and OneNews.PH articles describe the claim; neither says the data was reviewed or validated
• No sample records are visible in the circulated screenshot
• No NPC finding is available
• No public statement has been issued by the institution

If USLS issues a statement or the NPC publishes a finding, this entry will be updated in line with the SchoolBreach.org methodology.

USLS was previously tracked on this site for the June 2020 Pinoy Grayhats breach of its student portal. That incident is unrelated to this claim.

Threat-Actor Persona and Cross-References

The alias pocherowithpetchay has not previously appeared on this site. Two features tie the post closely to the forum post behind the NEUST admission-records exposure, posted by imken on November 5:

• The text is nearly identical. Both posts open with the same accusation, citing an "ongoing audit," describing data left "wide open for anyone to take," and closing that the institution "failed the people of the Philippines." The manifesto paragraphs that follow match almost word for word, with the date changed from November 5 to November 6.
• The greetz line names imken. It reads Deep Web Konek, DeathNote Hackers, DNH Klammer, Imken, W3MBY_1337, Ph D3STR0Y3R, and Assembly. W3MBY_1337, Assembly, and a "Ph." variant of D3STR0Y3R also appeared in imken's greetz line.

That pattern suggests either the same author under a second account or a shared template within one group. Nothing visible settles which. NEUST has since confirmed its claim was genuine, which is relevant context but not corroboration of this one: a template can be reused regardless of whether the underlying data is real.

The greetz line also places the post in the Deathnote Hackers Million Mask March network seen in the EVSU HRMIS access claim and the CvSU General Trias student records claim, both of which credit DNH Klammer. Its greeting to Deep Web Konek does not indicate any affiliation; DWK is an advocacy group that reports on such claims.

Why This Claim Warrants Attention

• Medical records are claimed. Health information is sensitive personal information under RA 10173 and carries a higher risk of harm, including discrimination and targeted fraud.
• The data set supports targeted fraud. Names, addresses, birthdates, parents' contacts, and tuition balances together allow convincing payment-scam messages to families.
• Many records may belong to minors. Universities in the Philippines often run basic-education units, and incoming college students may be under 18.
• The confirmed sister claim raises the stakes. A post using the same template against NEUST proved genuine. That does not verify this claim, but it means it should not be dismissed as boilerplate.
• The hidden block suggests distribution. Reply-to-view content is commonly a sample or download link, so the data may already be reachable by forum members.

What Is Not Known

• Whether the data is real. No sample is visible, and no independent party has reported reviewing it.
• Which system was exposed and how.
• What the hidden block contains.
• Whether the exposure is still open.
• Whether the institution is aware. No public statement has been observed as of this entry.

Recommended Actions for the Institution

1. 1.Treat the claim as credible until it is ruled out, given that the same template preceded a confirmed exposure elsewhere.
2. 2.Search for the exposure the post describes. Check student, clinic, registrar, and finance systems, archived databases, backups, exports, cloud storage, and APIs for data reachable without authentication.
3. 3.Preserve logs before remediation. Copy web, application, database, and storage access logs to isolated storage before changing anything.
4. 4.Close any open access and rotate credentials for affected systems, including database and service accounts.
5. 5.Notify the National Privacy Commission within 72 hours under RA 10173. Claimed exposure of medical records and minors' data is well inside the threshold.
6. 6.Issue a same-day public advisory to students and parents, warning in particular about tuition-payment scams that cite real balances. NEUST's same-week advisory on the related claim is a recent example of a prompt, specific response, and the Assumption College of Davao ICTC advisory is another.
7. 7.Monitor the forum thread for a sample, sale, or release, and preserve evidence for the NPC and law enforcement.
8. 8.Refer the incident to law enforcement, through the PNP Anti-Cybercrime Group or the NBI Cybercrime Division.
9. 9.Handle the separate conduct allegations through the institution's own processes, independently of the data-security response.
10. 10.Set up a single point of contact for affected students and parents.

How to Prevent This Pattern

1. 1.Separate health records from general student systems, with stricter access controls and logging.
2. 2.Inventory archived and legacy databases. The related NEUST exposure came from an archived admission database.
3. 3.Require authentication on every endpoint that returns personal data, and test for it each term.
4. 4.Apply retention limits and take records of former students offline.
5. 5.Monitor for bulk access and unusual downloads.
6. 6.Pre-stage a breach advisory template.
7. 7.Publish a security contact and responsible-disclosure policy.