The University of Zagreb Faculty of Science Listed by nova Ransomware Group

On July 2, 2025, the University of Zagreb Faculty of Science appeared on the leak site of the nova ransomware group. The attackers claim to have stolen internal files from the Croatian institution, known locally as Prirodoslovno-matematički fakultet or PMF. While the exact number of people affected remains unknown, anyone whose personal, academic, or employment records were stored on the compromised systems could now face long-term exposure.

What Public Reporting Shows

Public reporting indicates that nova posted the PMF data on its dark-web leak site, accessible via the .onion address tracked by ransomware.live. The university has not yet issued a detailed public statement confirming the volume or exact nature of the stolen material. Available reporting describes the incident as a ransomware attack in which files were first exfiltrated and then threatened with publication unless demands were met. No confirmed deadline for further leaks has been widely reported as of this writing.

Why This Matters for You and Your Family

Universities hold sensitive information on students, alumni, faculty, staff, and sometimes their family members. Internal files can include names, addresses, dates of birth, academic records, tax documents, medical information tied to campus services, and email correspondence. If your data or a family member’s data was stored at PMF, it is now at risk of being downloaded by anyone who visits the leak site. Once files leave a controlled environment, they can be reposted on multiple forums, sold, or used to launch further attacks against you.

Credential leaks from educational institutions frequently cascade into personal email takeovers, banking fraud, and doxxing. Children or young adults who attended or applied to the faculty may have gaming accounts, social-media handles, or family-shared emails linked to the same information. A single breach can therefore ripple outward and expose an entire household.

The Doxxing and Identity-Chain Implications

When internal university files appear in ransomware leaks, attackers and opportunistic criminals often map disparate pieces of data into a complete identity profile. An email address found in one document can be matched with a phone number in another, then linked to social-media accounts or children’s online gaming profiles. This identity-chain process turns a single leak into repeated harassment, targeted phishing, or extortion attempts that can last for years. Public reporting shows that ransomware victims’ data frequently resurfaces on multiple platforms long after the initial posting.

What to Do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Rotate any password you ever used at the University of Zagreb or PMF and enable two-factor authentication through an authenticator app everywhere that password was reused.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that chain back to the same address or identity details.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident underscores a simple reality: once data leaves an institution’s control, you cannot rely on the organization to protect you indefinitely. A forward-looking approach means treating every breach as a prompt to lock down your digital footprint before criminals connect the dots. DoxxScan by GalaxyWarden delivers exactly that layer of defense through continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that reveals how your information links together, hands-on remediation by specialists who manage takedowns, and full household coverage that includes your children’s gaming accounts where credential leaks so often begin. Starting these protections now limits the damage from both this leak and the ones that will inevitably follow.