MANILA, Philippines – A total of 210,020 records and documents related to a database apparently connected to the Online Voucher Application (OVAP) program of the Department of Education (DepEd) were found to have been unsecured and not password-protected, a security researcher with VPN Mentor reported on Tuesday, February 20.

In the report, security researcher Jeremiah Fowler noted the unsecured database – 153.76 GB in size – held “numerous documents that contained PII (personally identifiable information), including tax filings, voucher applications, parent or guardian consent forms, financial assistance, local government certifications, certificates of employment, death certificates, and other notarized or official documents.”

The OVAP is the digital platform set up by the DepEd and the Private Education Assistance Committee (PEAC) for applying for financial aid.

Speaking with Rappler, Fowler said that while the database has since been secured after he reported it to the DepEd and the National Privacy Commission, “there is no indication of how long it was exposed or who may have accessed these documents.”

When it was unsecured, the database could have been a potential vector to allow for financial fraud and identity theft if the data was exfiltrated or copied. The PIIs and photos of the students, being crucial for verifying the identity of a voucher applicant, could also put the students at risk of impersonation.

Said Fowler in his report, “Children’s personal data is particularly sensitive, presenting a lifelong risk due to its vulnerability to future exploitation. Protecting children’s data is crucial as it safeguards their privacy, prevents potential harm, and helps establish a secure foundation for their future digital interactions and identities.”

The full report is available here. – Rappler.com