A report by cybersecurity firm vpnMentor revealed that the data of over 200,000 students and parents on a Philippine education platform was exposed for an undisclosed duration.
The digital platform OVAP allows eligible students to seek financial aid for Senior High School education in private or non-public schools. It is jointly managed by the Philippines’ Department of Education (DepEd) and the Private Education Assistance Committee (PEAC).
The exposed data was discovered by cybersecurity researcher Jeremiah Fowler, who reported it to vpnMentor. Fowler found a non-password protected cloud storage database with a file size of 153.76GB containing 210,020 records.
The researcher said the database was associated with the OVAP. It had numerous documents, including tax filings, voucher applications, parent or guardian consent forms, financial assistance, local government certifications, certificates of employment, death certificates, and other notarized or official documents. It also contained image files (profile photos) of the children.
A disclosure notice was immediately sent to DepEd and the National Privacy Commission (NPC). The agencies replied that they had secured the database and were investigating the matter further. It is also unclear how long the records were exposed or if anyone else has gained access to the database.
The exposure of OVAP documents places the applicants and their families at risk of financial fraud, phishing attempts, or identity theft.
The DepEd and the NPC have not yet released any official statement regarding the data breach or its impact on the applicants and their families.
vpnMentor was the cybersecurity firm that reported the exposed PNP Employee database in 2023 and the Proud Makatizen Covid-19 portal vulnerability in 2022.
Source
Image credit: Unsplash
