Over 200-K school records compromised in data breach

CYBERSECURITY researcher Jeremiah Fowler discovered and reported to vpnMentor a non-password-protected database containing more than 200,000 records, which included sensitive files containing personally identified information (PII) of students and parents

The non-passwordprotected cloud storage database contained a total of 210,020 records with a size of 153.76 GB. Upon further research, the documents indicated they were associated with a program called the Online Voucher Application (OVAP). This is the digital platform established by the Philippines’ Department of Education (DepEd) and the Private Education Assistance Committee (PEAC).

“I immediately sent a responsible disclosure notice to the DepEd and the National Privacy Commission (NPC) of the Philippines. I received a reply from the NPC shortly after, claiming that they had secured the database and were investigating the matter further,” he wrote.

It is not clear who owned and managed the database. It is also unclear how long the records were exposed or if anyone else may have gained access to the database, potentially compromising a wealth of personal data belonging to the students and their families. Only an internal forensic audit would be able to identify unauthorized access or potential malicious activity.

Inside the database, he reportedly saw numerous documents that contained PII, including tax filings, voucher applications, parent or guardian consent forms, financial assistance, local government certifications, certificates of employment, death certificates, and other notarized or official documents. Tax records are considered highly sensitive as they contain the full name of the person who’s filing and their children, as well as their home address, phone number, employer, and tax identification numbers. The application folders also contained image files (profile photos) of the children.

The Department of Education developed the OVAP platform as a tool for eligible students seeking financial aid. Using OVAP, they can apply for vouchers to cover the costs of Senior High School education in private institutions or participating non-public schools. The platform allows students or

THIS image is a collage he created as an example of how pictures of the children appeared in the applications stored in the non-password-protected database.