bg.ac.rs Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
bg.ac.rs has been listed by the apt73 ransomware group, with internal files reported exfiltrated in the attack. The incident was disclosed on April 27, 2026; an undisclosed number of people may be affected, and anyone connected to the organisation should check their status and review their accounts.
What happened
The listing states that internal documents, letters, attachments and financial reports were taken from the organisation. No further technical details about the intrusion method, the duration of access or the scale of the operation have been released by either the group or the university. The claim appears only on the group’s leak site and has not been independently verified in public reporting.
Who is apt73?
apt73 is a ransomware operation that publishes the names of organisations on its data-leak site after encryption and exfiltration. Groups of this type typically gain initial access through phishing, remote-desktop vulnerabilities or compromised credentials, then move laterally to locate and copy files before deploying encryption. Their public listings serve as a pressure tactic to encourage payment; the accuracy of any individual claim varies and requires separate confirmation.
About bg.ac.rs
bg.ac.rs is the primary internet domain of the University of Belgrade, Serbia’s oldest and largest public university. Institutions of this kind maintain records on current and former students, academic staff, research projects, administrative correspondence and institutional finances. A breach at a national university can therefore involve both personal identifiers and sensitive operational material that is not normally released to the public.
The information in question
The listing describes internal documents, letters, attachments and financial reports. No inventory of specific file names, record counts or data categories beyond these general descriptions has been published. It is therefore not possible to state with certainty which individuals or datasets are included.
Why it matters
University records often contain identification numbers, contact details, academic histories and limited financial information. Exposure of such material can facilitate targeted phishing, identity misuse or reputational harm to the institution. Because the exact scope remains unknown, the practical consequences for any single person cannot yet be quantified.
If your data was in this claimed breach
Monitor official statements from the University of Belgrade for guidance on notification or support. Enable multi-factor authentication on all accounts that use university-linked email addresses and review recent financial statements for anomalies. Individuals may also run a free exposure scan of their email address against known breach datasets to check for prior appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
mahidol.ac.th Listed by apt73 Ransomware Groupdunav.com Listed by apt73 Ransomware Groupwesternint.com Listed by apt73 Ransomware Groupvicentetrapani.com Listed by apt73 Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the bg.ac.rs Listed by apt73 Ransomware Group →
Publicly posted by apt73 — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.