Around the 2026 Million Mask March, threat actors posted at least six data-breach claims against Philippine schools within days. Only two schools have spoken publicly. Here is what was claimed, how most of the silent schools came to be named anyway, and what schools should do before next November 5.
Between November 4 and 8, 2026, threat actors published at least six separate data-breach claims against Philippine schools. Five were tied directly to the Million Mask March on November 5 through the hashtag #MMM2026; the sixth came three days later from one of the same groups. The claims appeared on Facebook pages and on an underground cybercrime forum, and together they describe exposed records for well over 100,000 students, applicants, and staff.
One of the six has been confirmed by the school itself, and a second school has publicly said it mitigated an incident. The others remain unverified claims. SchoolBreach.org tracks each one as a separate entry, and keeps the institutions behind unconfirmed claims anonymous until the school speaks, the NPC publishes a finding, or mainstream media names them, in line with our methodology. By November 11, news coverage had also named three of the four schools that remain silent.
Schools were not the only targets. In the same week, monitoring groups and news outlets reported claims against several national government agencies. BetterGov.PH's list of systems reportedly affected on November 5 included government agencies and one of the universities below, and Rappler reported that list. On November 11, OneNews.PH reported on a Deep Web Konek intelligence assessment of underground disclosures from November 5 to 7 that lists 23 institutions, including national agencies, military and law-enforcement systems, and four of the universities below. BetterGov.PH noted that those incidents coincided with the Million Mask March, while also cautioning that no connection between the march and the attacks had been established. For the school claims, the connection is not in doubt: the posts themselves name the march.
There were also defacements. Nullsec Philippines' own November 5 post listed defaced pages at five websites, two of them belonging to Alliance Graduate School, and promised "more leaks and defacements" to follow. Defacements without a data claim are tracked separately and are not counted among the six data-breach claims below.
The Million Mask March is an annual protest associated with the hacktivist collective Anonymous, held on November 5. The date comes from Guy Fawkes Night, which marks the failed Gunpowder Plot of 1605 in England. Protesters usually wear Guy Fawkes masks, and rallies have been held worldwide every year since 2013.
In the Philippines, BetterGov.PH has noted that similar incidents on Philippine websites occurred around the date in previous years. In 2026, the school-related posts quoted the "Remember, remember, the 5th of November" verse, used slogans such as "Wake up. Speak up. Stand up.", and framed their claims as protest rather than profit.
Several posts were announced in advance or apologized for being late. One actor posted on November 4 that it would "bring these concerns to public attention" the next day. Another opened with "Yes, we're a day late." That tells schools something useful: this kind of activity is predictable. November 5 comes every year.
The posts cross-reference each other. Deathnote Hackers and the alias DNH Klammer appear in at least three of them. Greetz lines (the list of handles an actor thanks at the end of a post) overlap across the forum posts, and two forum posts share almost the same manifesto, word for word. That manifesto is also the one Nullsec Philippines published on its own page on November 5, which ties the forum accounts to the Nullsec network. Under our methodology, posts from the same network do not corroborate each other, but the overlap shows a coordinated campaign rather than six unrelated incidents.
Every claim presents itself as a public service: an "ongoing audit," an "unsolicited VAPT," a "security assessment," or responsible disclosure that went unanswered. Whatever the motive, the effect for students is the same. Their data was taken, and in several cases parts of it were published as proof.
The data described is not a single table or a defaced homepage. It is the full identity set a school holds: names, addresses, birthdates, parents' details, grades, enrollment, tuition balances, and in one case medical records. Two claims also describe administrator credentials or default-password patterns, which put the integrity of grades and records at risk, not only their privacy.
NEUST's confirmed exposure came from an archived database that was no longer part of its active admission system. Records kept "just in case" are still reachable unless they are deleted or taken fully offline.
Of the six schools, only two have spoken publicly. NEUST published an advisory confirming the exposure, explaining which database and which applicants were involved, which systems were not affected, and what it had fixed. That advisory turned "81,000 students exposed" into a specific, bounded account that applicants and parents could act on. EVSU followed on November 11, six days after the claim, with a statement that it had addressed and mitigated an incident involving its online services. It credited a white-hat collaborator, but did not say which system was affected or whether employee data was accessed.
The other four have said nothing publicly. Three of them, UCN, the CvSU General Trias campus, and USLS, are named on this site only because OneNews.PH and Unbox PH reported them. The fourth, because of how SchoolBreach.org works, remains anonymous here.
The attackers' own message is consistent across the posts: the schools knew, or should have known, and did nothing.
These are the attackers' accounts, and they serve the attackers' purposes. Only the UCN timeline can be checked against public posts; the private reports and the schools' responses cannot be verified from outside. But the pattern matters even if each detail cannot be confirmed. A vulnerability that is reported, ignored, or patched only on the surface does not stay private. It comes back, often on a date chosen for maximum attention, and the students are the ones who pay for it.
It is also why a security contact and a responsible-disclosure policy matter. In at least one of these cases, the finder says the report went to student organizations because there was no obvious channel to the people who could fix the problem.
Our methodology does not name a school on the strength of a threat actor's post alone. A claim can be exaggerated, recycled, or false. Naming a school on that basis would hand the threat actor the publicity it wants and pin an unproven accusation on the institution. So an unconfirmed claim stays anonymous until the school makes a statement, the NPC publishes a finding, or mainstream media names it.
The rule has a side effect we should be honest about: the school that tells the truth is the one that gets named on its own terms. NEUST is identified on this site because it did the right thing, and EVSU was named before it spoke because others had reported it. Of the four schools that remain silent, three are named only because monitoring groups and the media reported them, and one is not identified at all. None of the four has told its students and parents what was claimed, and the students of the one still anonymous school may never learn of it.
This is not limited to November 5. Of the 50 incidents tracked on this site so far in 2026, 34 are anonymized, almost always because the school never acknowledged them. Across the whole tracker, 78% of anonymized entries are high or critical severity, compared with 60% of named ones. The schools that stay silent are disproportionately the ones facing the most serious claims.
Silence does not make a breach go away. It means the threat actor's post is the only public account, and students cannot protect themselves from risks they do not know about.
Being named on this site is not a mark against NEUST. It reflects that NEUST was the first of the six, and the most specific, in being open with the people whose data was involved.
In a November 6 statement, NPC spokesperson and Deputy Privacy Commissioner Jose Belarmino II said "the Commission has not received personal data breach notifications from the concerned government agencies in relation to the reported incidents." The NPC said it would coordinate with the agencies to "verify the alleged incidents, ascertain the circumstances surrounding them, and determine whether personal data have been compromised," and added that "reports of alleged data leaks do not, by themselves, establish that a personal data breach has occurred or that the provisions of the Data Privacy Act of 2012 have been violated." Where warranted, it will require the agencies concerned to submit the necessary reports. State universities such as NEUST and EVSU are government institutions, so the same process applies to them. That does not mean institutions can wait. Under NPC Circular 16-03, personal information controllers must notify both the NPC and the affected data subjects within 72 hours when there is knowledge of, or reasonable belief that, a notifiable personal data breach has occurred. The trigger is reasonable belief, not certainty.