The University of Zagreb Faculty of Science Listed by nova Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People connected to the University of Zagreb Faculty of Science may now face uncertainty about whether their personal or professional information has been taken without authorization. When a ransomware group claims to have stolen internal files from an academic institution, the immediate concern is practical: students, staff, researchers and alumni could see private records surface in ways that enable fraud, identity misuse or unwanted contact.

Public reporting on 2 July 2025 states that the faculty has been listed by the nova ransomware group. The number of people affected remains unknown, and the precise contents of any stolen material have not been independently confirmed. What is known is limited to the group's claim of an attack involving the exfiltration of internal files.

Inside the incident

According to available public information, the University of Zagreb Faculty of Science was listed by the nova ransomware group on or around 2 July 2025. The listing asserts that internal files were exfiltrated during a ransomware attack. No further verified details have been released about the date the intrusion began, how access was obtained, the volume of data taken, or whether systems were encrypted as well as copied. The number of individuals potentially affected is listed as unknown. Independent confirmation of the group's claims has not been published, so the listing itself remains an unverified assertion by the actors involved.

Inside nova

Nova is a ransomware group that has operated by targeting organisations, encrypting systems where possible, and exfiltrating data to pressure victims into paying a ransom. Like many such groups, it maintains a leak site on which it publicly names organisations it claims to have compromised and sometimes releases samples or larger sets of stolen material if demands are not met. Its typical tactics include initial access through common vectors such as phishing or unpatched remote services, followed by lateral movement, data theft and deployment of encryption tools. Prior activity attributed to the group has involved a range of sectors, including education and research institutions. In this case the group claims the University of Zagreb Faculty of Science is a victim; that claim has not been corroborated by the faculty or by independent investigators in the information currently available.

About University of Zagreb Faculty of Science

The University of Zagreb Faculty of Science, known in Croatian as Prirodoslovno-matematički fakultet or PMF, is a major academic unit within Croatia's oldest and largest university. It focuses on education and research across the natural sciences, mathematics and related disciplines. Faculties of this type routinely manage large volumes of sensitive information: student academic records, staff employment and payroll data, research datasets, grant documentation, correspondence, and systems that support teaching and laboratory work. A breach at such an institution is consequential because the data often spans years of academic careers, includes personal identifiers of young adults and international researchers, and can contain unpublished scientific material whose premature disclosure could affect careers or intellectual property. The faculty's role in Croatia's higher-education and research ecosystem means any compromise can also raise wider questions about the security of public academic infrastructure.

The information in question

The only data types named in connection with the incident are internal files said to have been exfiltrated in a ransomware attack. No inventory of specific file categories, record counts or individual data fields has been disclosed. Organisations of this kind typically hold student enrolment and grade information, staff personal and financial details, research proposals, laboratory records, email archives and administrative documents. Because the exact contents remain unconfirmed, it is not possible to state with certainty which of these categories, if any, were taken. Readers should treat any circulating claims about particular documents as unverified until official notification or forensic reporting becomes available.

What's at stake

For individuals, the practical risks include identity theft, phishing campaigns that reference real academic details, and potential misuse of contact or financial information. Researchers may face exposure of unpublished work or collaboration records. For the faculty itself, the stakes include operational disruption, the cost of investigation and remediation, possible regulatory obligations under data-protection rules, and reputational damage that can affect student recruitment and research partnerships. Because the scale remains unknown, the full extent of these risks cannot yet be quantified.

Were you affected?

If you have studied, worked or collaborated with the University of Zagreb Faculty of Science, treat the listing as a reason for caution rather than confirmed personal exposure. Practical first steps include:

• Monitor bank and credit accounts for unexpected activity and consider placing fraud alerts where available.
• Be sceptical of unsolicited emails or messages that reference the faculty or request personal information; verify any official communication through known channels.
• Change passwords on accounts that reused credentials associated with university systems, and enable multi-factor authentication wherever possible.
• Watch for official statements from the faculty or university about notification procedures and support.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That check will not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.