Croatianmint.hr listed on IMNCrew leak site

• Ransomware group: IMNCrew
• Country: Croatia
• Sector: Professional Services
• Announcement date: May 5, 2025

Croatianmint.hr listed on IMNCrew leak site

The threat actor group known as IMNCrew has officially listed Croatianmint.hr on its leak site. This announcement, made on May 5, 2025, marks a significant development regarding the security posture of the organization, as the group claims to have successfully executed a cyberattack against the entity.

Details of the alleged attack

According to the announcement posted by IMNCrew, the group claims to have gained unauthorized access to the systems belonging to Croatianmint.hr. The threat actors allege that this access allowed them to exfiltrate data from the organization's internal environment. While the group has made these claims public, it is important to note that public information regarding the specific tactics, techniques, and procedures used by the IMNCrew group remains limited.

In modern cyber threat landscapes, such listings are often part of a double extortion strategy. In these scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the stolen data on a public forum, the attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential information. This method increases the pressure on organizations, as the risk shifts from mere operational downtime to significant reputational and legal consequences.

Data involvement and claims

Regarding the specific nature of the information allegedly stolen during the breach, the threat actor group has provided no details or sample files. At this stage, there is no information available concerning the specific types of data, the volume of files, or the total size of the data allegedly exfiltrated by the group.

• No data types were specified in the listing.

The lack of provided samples or specific file descriptions makes it difficult to immediately assess the exact scope of the potential exposure. In many ransomware incidents, the absence of immediate data samples is common during the initial phase of a leak site announcement, as attackers may use the threat of future disclosure to initiate negotiations.

Organization profile

Croatianmint.hr, known as Hrvatska kovnica novca (Croatian Mint), is the official institution responsible for the production of circulating and commemorative coins. Additionally, the organization is responsible for producing gold and silver medals for Croatia. Beyond its official duties, the company offers a wide range of precious metal products through both retail and wholesale channels.

Risk assessment and organizational implications

The inclusion of Croatianmint.hr in a ransomware leak announcement indicates a potential risk of exposure for sensitive corporate or customer data. Because the organization is based in Croatia, any confirmed data breach may fall under the regulatory scope of the European Union's General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on how personal data must be protected and how breaches must be reported.

The potential publication of sensitive data could lead to various negative impacts on the organization's reputation. Furthermore, such leaks can create secondary risks for the organization's customers, including the possibility of identity theft or targeted phishing attacks. When personal or corporate information is leaked, attackers often use it to conduct more sophisticated social engineering campaigns against the individuals involved.

For organizations operating in the professional services and official institutional sectors, maintaining robust operational security is vital. This includes continuous monitoring of threat actor actions regarding ransom demands or data dissemination. Defensive strategies typically involve implementing strong access controls, maintaining offline backups, and ensuring comprehensive encryption for data at rest and in transit. As the situation regarding IMNCrew's claims evolves, the organization's security posture and the subsequent actions of the threat actor will require close monitoring to mitigate further risks.