Croatia’s education system has been shaken by one of its most serious cybersecurity incidents after an online forum published a database containing information on more than 560,000 students, teachers and school staff.
According to Croatian media reports, the leaked database contains 563,509 unique records from 1,452 educational institutions across the country. Journalists from Dnevnik.hr reportedly verified the authenticity of the data by checking records belonging to their own family members, colleagues and educational institutions.
The exposed information includes names, surnames, school affiliations, user roles and official email addresses using the @skole.hr domain. Experts have expressed particular concern because the leak involves data related to minors.
Initial analyses suggest that the leaked records may originate from an older system backup or from a connected application that contained only activated user accounts, as the database appears to include older students while excluding younger generations.
Cybersecurity specialists have warned that the exposed data could be used for targeted phishing campaigns, social engineering attacks and potential identity theft.
Croatia’s Academic and Research Network (CARNET) confirmed it had launched an extensive technical and forensic investigation immediately after becoming aware of the breach.
“CARNET is aware of the unauthorized sharing of data related to primary and secondary schools. An extensive technical and forensic analysis is underway to determine the authenticity, scope, origin and method of publication of the leaked data,” the organization said in a statement.
Authorities stressed that the leaked information does not currently appear to provide direct access to user accounts. However, users have been urged to exercise increased caution when receiving emails requesting login credentials or personal information.
The Croatian Ministry of Science, Education and Youth has not yet issued an official statement on the incident. Investigators are now attempting to determine the source of the leak, whether security protocols were breached, and who may be responsible for exposing the data.