Croatianmint.hr Listed by IMNCrew Ransomware Group

On May 5, 2025, the Croatian mint operator Hrvatska kovnica novca appeared on the leak site of the ransomware group IMNCrew. The company, which produces circulating coins, commemorative coins, gold and silver medals, and base-metal awards sold through its webshop, is claimed to have had internal files exfiltrated during a ransomware attack. While the exact number of people whose information may have been exposed remains unknown, anyone who has purchased from the site, provided personal details for custom orders, or whose data was stored in the company’s internal systems may be affected.

What's Publicly Reported from Reporting

Public reporting indicates that IMNCrew listed Hrvatska kovnica novca after the company apparently did not meet the group’s demands. The data taken consists of internal files rather than a simple database dump. No precise count of records has been published, and the precise date of initial compromise is not yet confirmed in available reporting. The leak site posting on May 5 serves as the public confirmation that exfiltration occurred and that the files are now in the hands of the attackers.

Why This Matters for You and Your Family

When a company that handles orders for weddings, graduations, religious ceremonies, and other personal milestones is breached, the information exchanged during those transactions can include names, addresses, phone numbers, email addresses, and payment details. If you or anyone in your household has ever bought a commemorative coin, medal, or gift from Croatianmint.hr, your details may now sit in a ransomware leak. That exposure creates a direct path for identity theft, phishing campaigns, or unwanted contact that can affect your family’s privacy and finances for years.

Credential leaks like this one frequently cascade into account takeovers elsewhere because people reuse the same email-and-password combinations across services. A single purchase at a mint can therefore endanger logins used for banking, email, or children’s online gaming accounts.

The Doxxing and Identity-Chain Implications

Once internal files leave a company’s control, attackers and opportunistic criminals can piece together scattered pieces of your life. An email address found in the mint’s records can be cross-referenced with gaming usernames, social-media handles, or old forum posts. This identity-chain process turns one breach into a map that reveals where you live, who your children are, and which accounts they use. The result is often doxxing: publication of personal information intended to harass or extort. Gaming accounts belonging to children are especially vulnerable because they frequently share the same household email or phone number listed in adult purchase records.

IMNCrew’s Publicly Known Track Record

Public reporting attributes IMNCrew with emerging in late 2024 as a ransomware operation that combines double-extortion tactics with leak-site publication. The group has listed a range of victims including manufacturing firms, service providers, and smaller government-linked entities. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive files, encryption of systems, and demands for payment to prevent data release. When payment is not received, IMNCrew posts samples and eventually the full archive on their onion site, as occurred with Hrvatska kovnica novca.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity so you can see exactly what chains back to the Croatian mint breach.
• Rotate the password you used at Croatianmint.hr anywhere it is reused and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours instead of months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts sharing the same address or contact details.
• Let remediation specialists handle takedown requests across data brokers and exposed records while you focus on securing your own accounts.

The incident shows that even specialized national institutions handling everyday personal occasions can become targets, leaving ordinary customers exposed. Taking concrete steps now limits how far the leaked files can travel. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting that process today turns a passive leak into a managed risk.