Serbia
Public Health / Government
Mirrored Distribution
Serbian National Health Insurance Databases Allegedly Published Across Multiple File Mirrors
A forum user posting as bytetobreach claims to hold databases belonging to RFZO, the Republic Fund for Health Insurance of Serbia, and has posted links to the material across five separate file hosting services. The poster states the largest tables hold around 8 million rows, and estimates roughly 5 million individuals once duplicates and corrupted records are discounted, a figure approaching the size of the Serbian population. Unusually, the post states that RFZO was notified directly and that no ransom was demanded, while also saying the data will not be given to unknown parties. Field level contents are not itemised in the post. The claim is unverified.
▣Post details
Serbia!What the post claims
- Multiple RFZO databases
- Largest tables near 8M rows
- Roughly 5M after dedupe
- Duplicates and corruption noted
- Preview images attached
- Five mirror locations
- Mainstream cloud hosts used
- RFZO notified directly
- No ransom demanded
- No demand to Serbian state
- Withheld from unknown parties
- Four contact channels given
- Account created Mar 2026
- No field list published
◱Screenshot
⚠Potential impact
The post does not enumerate the fields, so what follows rests on the nature of the organisation rather than on published samples. A state health insurance fund holds identity and entitlement records for essentially the whole insured population, and the estimate offered would cover a majority of Serbian residents. Even at the least sensitive end, records of that type generally establish who a person is, where they live, and that they are enrolled, which is durable identity data that cannot be reissued the way a password can. Any clinical or entitlement detail would raise this considerably, since health information carries discrimination and extortion risk that ordinary breach data does not. The distribution method compounds it: the material is described as sitting on mainstream consumer file hosts rather than behind a forum paywall, so takedowns are possible but copies are cheap to make and the poster's stated intent to restrict access is not enforceable once the links circulate.
iStatus
UnverifiedThis post carries less supporting evidence than usual. There is no schema, no field coverage table, and no record sample in the thread, only a logo image, mirror links, and preview screenshots. The row counts and the five million figure are the poster's own estimates and are explicitly hedged in the post itself. The stated position is also internally inconsistent, since the thread is tagged as a sale while the text says the data is not for sale to unknown parties and that no ransom was sought. Dark Web Informer is not reproducing the mirror links, the preview image links, or any of the contact routes given. The claim is unverified and RFZO has not publicly addressed it.
DARK WEB INFORMER - THREAT INTELLIGENCE
