bg.ac.rs Listed by APT73 Ransomware Group

On April 27, 2026, the University of Belgrade appeared on the leak site of the ransomware group apt73, with attackers claiming to have exfiltrated internal documents, letters, attachments, and financial reports from the Serbian university’s systems.

What Public Reporting Shows

Public reporting indicates the university’s domain bg.ac.rs was listed by the group on that date. The posted data consists of internal files taken during a ransomware incident. Exact victim counts within the university community remain unknown, though the breach involves sensitive institutional records that could affect students, faculty, staff, and anyone whose personal information appears in those documents. The total size of the leaked material has not been independently verified in open sources.

April 27, 2026 marks the public listing. The exposed materials include correspondence and financial information that, once published, cannot be retracted. No official statement from the university detailing the initial intrusion vector or exact scope has been widely reported.

Why This Matters for You and Your Family

Universities hold records on millions of current and former students, their parents, spouses, and sometimes siblings. If your name, address, date of birth, national ID number, or financial details were ever submitted to the University of Belgrade, those records may now sit in a ransomware leak. Once data leaves institutional control, it travels quickly through underground markets.

Internal documents and financial reports often contain more than names and dates. They can include scanned IDs, tax forms, payment histories, and correspondence that reveal family relationships, home addresses, and phone numbers. For ordinary people, this creates a permanent trail that identity thieves and harassers can follow for years.

The Doxxing and Identity-Chain Implications

A single university breach rarely stops at the initial leak. Attackers and subsequent buyers combine the new data with information from earlier breaches to build detailed profiles. An email address from this incident can be linked to gaming accounts, social-media handles, or family-member records, creating an identity chain that leads directly to you or your children.

Credential leaks of this type frequently cascade into account takeovers. A reused password taken from university systems can open the door to email, banking, or gaming platforms. Children’s gaming accounts are especially vulnerable because parents often share or reuse credentials across family devices. Public reporting shows these chains accelerate doxxing campaigns, where personal addresses, phone numbers, and family photos surface on harassment forums.

apt73’s Publicly Known Track Record

Public reporting attributes apt73 with emerging in late 2024 as a ransomware operation that combines encryption with data theft and extortion. The group has listed universities, municipal governments, and mid-sized companies on its leak site. Its typical playbook begins with initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of sensitive files before deploying ransomware. Extortion demands are issued with deadlines, after which stolen data is published in batches if payment is not received. Past victims include educational institutions and public-sector entities, though independent confirmation of every claim remains limited.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at the University of Belgrade or on bg.ac.rs anywhere else it is reused, and switch to 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often chain back to the same addresses and parent credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The University of Belgrade breach is a reminder that institutional systems holding your family’s information remain targets. Quick, decisive action can limit how far the exposed data travels. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects scattered handles to real identities, and hands-on remediation by specialists who manage takedowns for you. Its household coverage also protects children’s gaming accounts that frequently become the next link in doxxing chains after credential leaks like this one.