Phillipine Online Voucher Application leaks data of over 200,000 students

Jeremiah Fowler, a secuyrity researcher is reporting a non-password-protected cloud storage database was found exposed online containing 210,020 records, totaling 153.76 GB.

The database is associated with the Philippines' Department of Education (DepEd) and the Private Education Assistance Committee (PEAC) Online Voucher Application (OVAP) program. This program was established to facilitate the application process for financial aid for Senior High School education in private and non-public schools through the submission of electronic documents.

The database contained highly sensitive Personally Identifiable Information (PII), including:

• tax filings,
• voucher applications,
• consent forms,
• financial assistance documents,
• local government certifications,
• certificates of employment,
• death certificates,
• full names,
• dates of birth,
• addresses,
• phone numbers,
• employer details,
• tax identification numbers,
• image files of children.

Upon discovery, the researcher promptly notified DepEd and the National Privacy Commission (NPC) of the Philippines, which secured the database and initiated further investigations.

The ownership and management of the database, the duration of exposure, and whether any unauthorized access occurred remain unclear.