On May 23, 2025, Serbian IT services firm Informatika A.D. appeared on the leak site of the ransomware group Worldleaks. The company, which serves public administration, healthcare, financial institutions, telecommunications, energy utilities and other organizations across Serbia and beyond, is claimed to have had internal files exfiltrated during a ransomware incident. While the exact number of people whose data may have been exposed remains unknown, anyone whose records passed through Informatika’s systems — customers, patients, employees or contractors — may now be at risk.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Informatika A.D.
Get alerted the next time Informatika A.D. files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Informatika A.D.’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates that Worldleaks posted a listing for Informatika A.D. on its dark-web leak portal on May 23, 2025. The data consists of internal files exfiltrated after the group deployed ransomware against the Belgrade-based company. No precise victim count inside the leaked material has been disclosed, and the precise systems compromised have not been publicly detailed. Available reporting describes the incident as a classic ransomware attack that combined encryption with data theft for extortion.
Why This Matters for You and Your Family
When an IT services provider that works with government agencies, hospitals, banks and utilities is breached, the ripple effects reach ordinary people. Your medical records, tax filings, utility accounts, or employment information may have been handled by Informatika’s systems. Once those records leave a company’s control, they can be sold, posted or used to launch targeted attacks against you. Internal files often contain spreadsheets, emails, contracts and databases that include names, addresses, government ID numbers, phone numbers and financial details. For families, a single exposure can put every member at risk because addresses and family-member names frequently appear together in the same documents.
The Doxxing and Identity-Chain Implications
Leaked internal files frequently contain more than isolated records. They can link email addresses to phone numbers, customer IDs to home addresses, and employee logins to client projects. Attackers stitch these fragments together into an identity chain that reveals far more than any single breach suggests. A gaming username belonging to your child, an old family email address, and a parent’s work phone number can quickly connect to real-world identities. Credential leaks of this nature regularly cascade into account takeovers on gaming platforms, social media and email, opening the door to harassment, extortion or further data theft. Doxxing chains thrive on exactly this kind of interconnected information.