Jozef Stefan Institute (IJS) Listed by Coinbase Cartel Ransomware Group

On May 11, 2026, the Jozef Stefan Institute in Slovenia appeared on the leak site of the ransomware group known as coinbasecartel. The listing indicates that internal files were exfiltrated during a ransomware attack on the country’s leading research institution. While the exact number of people whose information may have been exposed remains unknown, anyone whose personal, employment, or project records passed through the institute’s systems could be affected.

What Public Reporting Shows

Public reporting indicates that coinbasecartel added the Jozef Stefan Institute to its data-leak page on May 11, 2026. The institute, headquartered in Ljubljana, conducts research across physics, chemistry, biochemistry, electronics, information technology, and environmental sciences. Available reporting describes the exposed material as internal files obtained after the group gained access to the organization’s networks. No confirmed total of records or specific data types such as names, emails, or financial details has been published by the attackers or the institute at the time of this writing.

Why This Matters for You and Your Family

When a research institute’s internal files are stolen, the information inside often includes details about employees, contractors, students, collaborators, and research participants. If you or anyone in your family has ever worked with, studied at, or been the subject of a project at the Jozef Stefan Institute, your personal information may now sit in a ransomware group’s hands. Names, contact details, and project affiliations can be combined with data from other breaches to build a profile that puts your family at risk of identity theft, phishing, or harassment. Children’s records linked to parental employment or educational programs are especially concerning because they can follow a young person for years.

The Doxxing and Identity-Chain Risks

Ransomware groups rarely stop at the first set of stolen files. Once internal documents leave an organization, attackers or buyers on underground forums can map connections between work emails, personal accounts, and family members. A single leaked work phone number or project roster can link to gaming usernames, social-media handles, and home addresses. These identity chains turn one breach into repeated targeting. Credential leaks like this one frequently cascade into account takeovers on personal services and children’s gaming accounts, where doxxing often begins.