Investigation launched after data breach exposes information of more than 560,000 students and teachers

An investigation and a comprehensive analysis are underway following a major security breach that exposed the personal data of more than 560,000 Croatian students and teachers.

CARNET, Croatia's national research and education network, confirmed it was aware of the incident and had hired external cybersecurity experts to determine who was responsible for the data leak. The exposed information includes users' names, email addresses, school names, and user roles.

The Personal Data Protection Agency has also launched an urgent supervisory investigation into CARNET.

Despite the breach, CARNET says its core services remain secure and fully operational.

"CARNET services are not under threat — everything is functioning normally. Users should also know that their passwords have not been compromised, nor has the authentication system. This means unauthorized access to user accounts is not possible," said Ana Smoljo, CARNET's Assistant Director for Digital Identity and Communications.

Science, Education and Youth Minister Radovan Fuchs said the incident had not affected key education systems.

"There have been no issues with daycare enrollment, the central student database, grading, high school enrollment, the national graduation exams, or the related college admissions process. None of these systems or processes have been compromised," Fuchs said.