The Department of Education (DepEd) confirmed that teachers’ email accounts were used in a days-long bomb threat hoax targeting roughly 6,300 schools across Italy.
Some of the hacked accounts used in the hoax were identified with the domain r11.deped.gov.ph, used by DepEd officials from administrative Region 11 or Davao.
“To contain the situation, DepEd immediately disabled the account to prevent further misuse, launched a thorough investigation, and implemented heightened cybersecurity measures to secure all official communication channels,” the press release on Nov. 13 read.
The emails exploited in the incident are not limited to the Philippines, with email domains from Taiwanese and Pakistani universities also used.
The sender, who identified himself as “Mikhail Andropov of Vilayat di Misoginistan,” exploited the hacked email accounts by sending messages claiming to have planted a bomb inside the building.
The email also contained threats to Palazzo Chigi and called on Italian Prime Minister Giorga Meloni to resign.
The threats are part of a larger cyberattack in Europe over the past two weeks, ranging from bomb threats across airports to fridges being hijacked in supermarkets.
DepEd has yet to confirm the amount of accounts compromised, but an independent investigation by cybersecurity advocacy group Deep Web Konek identified at least four DepEd emails, with two from the Davao region, exploited during the email hoax.
(Email bomb threat images from Deep Web Konek)
In an exclusive interview with PhilSTAR Tech, Deep Web Konek said that data breaches related to government agencies are a “highly critical” problem due to the sensitive information being obtained by threat actors, ranging from basic information such as names, addresses and contact numbers to confidential internal documents.
“Any of the [agencies], even if only one of them, should have been a priority of the government and treated with the highest level of priority as each government agency holds not just internal documents but also the data of the Filipino people,” the cybersecurity advocacy group said.
ScammEd?
The exploitation of DepEd email addresses to commit fraudulent or illegal activity is an overlooked lingering problem for the institution.
In a report by Italian outlet Decripto.org, they have identified that the same domain from the Davao region was exploited in a different incident as early as March 2025 to arrange fake job interviews in the United States.
The DepEd account was used to impersonate Marissa Lombardi, a human resources staff from Merz Therapeutics. In a post on LinkedIn, Lombardi warned against her impersonator with comments in the post stating they have received a message from the email [email protected].
(Image from LinkedIn)
More recently this year, a Facebook advisory from DepEd’s Cagayan de Oro division in October showed that a deped.gov.ph domain was used by hackers to pose as bank officials.
The email, which asked users to input their phone numbers while posing to be a banking entity, is a cyberattack known as phishing which aims for users to give away sensitive information.
(Image from Department of Education – Division of Cagayan de Oro City/ Facebook)
Vulnerable institutions
DepEd is not the only vulnerable institution in the government. The National Privacy Commission has confirmed on Nov. 10 that at least 10 government agencies were victims in a data breach the same month.
Palace Press Officer Claire Casto said the President is aware of the hacking incidents and added that previous hacking incidents were immediately addressed.
“The government is ready to respond against the cyberattacks that are occurring, the hacks against the websites, the government is ready,” Castro said on Nov. 12.
Deep Web Konek said that the common downfall of government agencies are infostealers and credential harvesting. The group estimates that 118,000 government credentials from DepEd alone were leaked from January to October this year, found on hacker forums.
“We advise government agencies to keep away or completely avoid downloading cracked software or apps and to separate their personal devices from work, since those are common sources of malware.”
