Croatianmint.hr Listed by IMNCrew Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised institutions and mid-sized commercial operators across Europe, often combining encryption with data theft to increase pressure. In this environment, the appearance of Croatianmint.hr on a leak site operated by the IMNCrew ransomware group forms part of a broader pattern of attacks against organisations that hold both operational and customer information.

Public reporting on 5 May 2025 stated that Croatianmint.hr had been listed by IMNCrew following a ransomware attack in which internal files were claimed to have been exfiltrated. The number of people affected remains unknown, and further technical details have not been released. The incident matters because the organisation produces circulating and commemorative coins and operates a webshop serving retail and wholesale customers, placing both institutional and personal data potentially at risk.

Breaking down the breach

According to the available record, Croatianmint.hr was listed by the IMNCrew ransomware group on or around 5 May 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No confirmed figure has been given for the volume of data taken, the number of individuals affected, or the precise date the intrusion began. Methods of initial access, the duration of the attackers’ presence, and any ransom demand remain undisclosed. The listing itself constitutes a claim by the group rather than independent verification that the data has been published or that negotiations have concluded.

Public detail is therefore limited to the organisation’s appearance on the leak site and the statement that internal files were removed. No official confirmation from Croatianmint.hr or Croatian authorities has been included in the source material used for this account.

Inside IMNCrew

IMNCrew is a ransomware operation that follows the now-common double-extortion model: systems are encrypted and data is copied before encryption so that the threat of public release can be used to compel payment. Like other groups of this type, IMNCrew maintains a dedicated leak site on which it posts victim names, sometimes accompanied by sample files or countdown timers. The group has previously listed organisations across several sectors, typically mid-sized companies and public-facing institutions whose data holds commercial or personal value.

Public reporting on IMNCrew’s tactics indicates reliance on standard initial-access vectors such as phishing, exploitation of unpatched remote services, or compromised credentials, followed by lateral movement and data staging. Specific claims made by the group about any single victim, including Croatianmint.hr, should be treated as unverified assertions until corroborated by independent evidence or the victim organisation itself.

Croatianmint.hr and its sector

Croatianmint.hr is the online presence of Hrvatska kovnica novca, the Croatian mint. The institution specialises in the production of circulating and commemorative coins as well as gold, silver and base-metal medals. It maintains a webshop that sells these items to both retail customers and wholesale buyers, often for occasions such as weddings, graduations and religious ceremonies. As a national mint it also contributes to Croatia’s monetary identity and economy.

Organisations of this kind typically hold manufacturing specifications, inventory and financial records, supplier contracts, and customer databases containing names, addresses, payment details and order histories. Because the mint combines sovereign functions with commercial sales, a compromise can affect both state-related operational data and private consumer information. The dual character of the business makes any confirmed breach consequential for institutional reputation and for individuals who have purchased products through the webshop.

What was likely exposed

The only data category named in the available facts is “internal files” said to have been exfiltrated in the ransomware attack. No inventory of file types, no sample listings, and no confirmation of customer records, employee data or financial documents have been published in the source material. Exact contents therefore remain unconfirmed.

In the ordinary course of business a mint and its associated webshop would be expected to store production schedules, design files, customer order and payment information, employee records, and correspondence with suppliers and government bodies. Whether any of these categories were among the files taken cannot be established from the public record. Readers should treat all statements about specific data elements as speculative until official disclosure occurs.

The real-world impact

For individuals, the primary risks associated with an unconfirmed internal-file exfiltration are identity misuse, targeted phishing that references genuine orders or personal details, and potential financial fraud if payment information was included. Because the number of people affected is unknown, the scale of these risks cannot yet be quantified. Customers who have used the webshop may face elevated vigilance requirements for several months.

For the organisation itself, consequences include possible operational disruption from encryption, costs of investigation and remediation, regulatory notification obligations under European data-protection rules, and reputational damage that could affect both retail sales and institutional relationships. Until more detail emerges, the full extent of these effects remains unclear.

Were you affected?

If you have purchased coins, medals or other products from Croatianmint.hr, or if you have had any other formal relationship with the mint, treat the possibility of exposure seriously. Monitor bank and card statements for unfamiliar transactions, be cautious of unsolicited emails or messages that reference past orders, and consider placing fraud alerts with relevant credit agencies. Change passwords on any accounts that reused credentials associated with the webshop. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official updates from the organisation or Croatian authorities should be followed as they become available.

AICompiled with AI assistance from public sources and published under our editorial standards.