{"id":7014,"date":"2025-04-15T19:00:00","date_gmt":"2025-04-15T11:00:00","guid":{"rendered":"https:\/\/sinag.press\/news\/?p=7014"},"modified":"2025-04-11T15:46:11","modified_gmt":"2025-04-11T07:46:11","slug":"water-damage-google-groups-leak","status":"publish","type":"post","link":"https:\/\/sinag.press\/news\/2025\/04\/15\/water-damage-google-groups-leak\/","title":{"rendered":"Water damage: Google Groups leak information of thousands of students, faculty, and staff across UP system for eight years"},"content":{"rendered":"\n

This article was written on April 7, 2025. In an effort to maintain responsible disclosure, we have informed UP ITDC about this leak on April 7, 2025 to give them time to adjust permissions and to enact appropriate privacy and security protocols.<\/em><\/p>\n\n\n\n

If you log in to your UP mail account right now and open up groups.google.com<\/a>, you should only see one, two, or maybe a few lists you happen to be on. On the left-hand side though, you\u2019ll see a little building icon on a section that says \u201cAll groups\u201d. When you click this, you should see a handful of email lists. A bit odd. You scroll through and you realize, \u201coh, that feels like information I shouldn\u2019t have.\u201d<\/p>\n\n\n\n

But even worse is when you click through into one of these Google Groups and realize you can read every single email in their threads<\/em>. This is the predicament SINAG found itself in last week when we discovered this from a rarely-used Google feature\u2013 Google Groups.<\/p>\n\n\n\n

<\/span>Splashing about<\/span><\/h2>\n\n\n\n

Google Groups is a service run by Google to facilitate threaded discussions of common interests. If you are familiar with usenet<\/a> and other discussion email threads and mailing lists from a long time ago, it is similar to that, but brought into the modern age.<\/p>\n\n\n\n

For those who are unfamiliar though, a \u201cmailing list\u201d is essentially an email address that forwards any email it receives to the people \u201csigned up\u201d to the list. For example, the UP System email blast system allows OVCSA to forward information and events to UPD students without having to list out each student individually.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

The intended purpose of Google Groups is, of course, simply to act like a decentralized forum based on a common mailing list address. However, as we have come to find out, these Google Groups are being treated like mailing lists, with reply-alls turning these threads into public-meant-private correspondence. As a result, these meant-to-be-fora have become a leaking ground for private information of students, faculty, and staff alike.<\/p>\n\n\n\n

<\/span>Here comes the flood<\/span><\/h2>\n\n\n\n

Worst hit among these is UP Manila, which has extensive Google Group mailing networks for a number of departments and colleges. While many of these emails are simply announcements befitting Google Groups and perhaps better served by a regular mailing list, a little bit of searching yields PDFs and spreadsheets with private information of thousands<\/em> of students, faculty, and staff since at least <\/em>2017<\/em><\/strong>.<\/p>\n\n\n\n

While we would like to study the extent of this leak, its size has also necessitated proper and responsible disclosure to ensure the security of people\u2019s private information. As a result, upon realizing how much information we were able to find, we compiled evidence of data leakage and sent a report to UP ITDC, alongside UPD\u2019s Data Protection Office. CC\u2019d in the email are the IT offices of UP Los Banos (UPLB Digital Innovation Center), UP Baguio (UPB LAN Office), UP Manila (UPM Information Management Service), and UP-PGH (UP PGH Information Technology Office).<\/p>\n\n\n\n

Here are some of the things we found as we looked through some of the emails:<\/p>\n\n\n\n