The University of Zagreb Faculty of Science listed by nova ransomware group

• Ransomware group: nova
• Country: Croatia
• Sector: Education
• Announcement date: July 2, 2025

The threat actor known as nova has listed The University of Zagreb Faculty of Science on its leak site, claiming to possess its data. This announcement, made on July 2, 2025, suggests a significant breach involving the academic institution.

Details of the alleged attack

On July 2, 2025, the nova group listed The University of Zagreb Faculty of Science on its leak site. The threat actor claims to have published various datasets allegedly obtained from the institution's networks. While the group has made this claim, public information regarding the specific methods, motivations, or identity of this group remains limited.

Ransomware groups often utilize leak sites as a tool for double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to release sensitive information publicly if a ransom is not paid. This tactic increases the pressure on the victim by threatening their reputation and legal standing. The use of a dedicated leak site allows the group to maintain a presence and signal their ability to compromise specific targets.

Data types mentioned in the announcement

The announcement made by the nova group specifies several categories of data that were allegedly compromised. According to the claim, the stolen information includes various sensitive datasets that could impact the institution's operations and the privacy of its members. The specific items mentioned include:

• Student reports
• Names
• Payment records
• Databases
• Certificates
• Network logs

The presence of such diverse data types, ranging from administrative records to technical logs, indicates a broad scope of the alleged intrusion. It is important to note that no specific information was provided regarding the total size of the data or the exact number of files involved in this incident.

The University of Zagreb Faculty of Science

The Faculty of Science at the University of Zagreb is a prominent academic institution located in Zagreb, Croatia. It is dedicated to education and research in the fields of natural sciences and mathematics.

Potential risks and organizational implications

The alleged leak may pose risks to the privacy of student and staff data within the university. The exposure of personal information could lead to identity theft or targeted phishing attacks against the affected individuals. When personal identifiers and contact information are leaked, attackers often use them to craft highly convincing social engineering campaigns to further compromise the individuals or the institution.

Furthermore, the potential exposure of network logs and certificates could increase the risk of secondary attacks against the institution's IT infrastructure. Technical assets like certificates and logs provide attackers with insights into the internal network architecture and security protocols, which can be leveraged to facilitate future unauthorized access or lateral movement within the network.

From a regulatory perspective, the institution may be required to fulfill data breach notification obligations under the European Union's General Data Protection Regulation (GDPR). Such regulations require organizations to take strict measures to protect personal data and to report significant breaches to the relevant authorities and affected individuals.

To defend against such threats, organizations in the education sector can implement various defensive measures. These include maintaining robust backup strategies to ensure data availability, implementing multi-factor authentication to secure access to sensitive systems, and conducting regular security awareness training for staff and students. Additionally, continuous monitoring of network traffic can help in the early detection of anomalous activities that might indicate an ongoing intrusion.