Actor claims to sell 1.5 million Sava Osiguranje customer records
A threat actor on an underground forum claims to have breached Sava Osiguranje, one of Serbia's largest insurers, and is selling a customer database of about 1.5 million records (1.2 GB), including JMBG citizen numbers, policy, vehicle and IBAN data. The claim is unverified and the company has not confirmed an incident. Monitor official channels and treat policy and payment messages with caution.
What happened
A threat actor on an underground forum claims to have breached Sava Osiguranje, one of Serbia's largest insurance companies, and is offering a customer database of about 1.5 million records (1.2 GB). The actor says the dataset includes Serbian citizen ID numbers (JMBG), policy details, vehicle data and IBANs. The claim is unverified and the company has not confirmed an incident.
Why it matters
If confirmed, the dataset would enable identity fraud and convincing fake renewal, claim and overdue-payment messages, according to the source's analyst note. Policyholders would be prime targets for scams. There is no official confirmation so far.
What to do
Await an official statement from Sava Osiguranje and monitor threat channels for verification or a data sample. Policyholders should distrust emails and messages about renewals, claims or payments and confirm through official channels.
For the technical team
- Affected
- Sava Osiguranje Base de clientes da Sava Osiguranje, uma das maiores seguradoras da Sérvia, segundo alegação em fórum subterrâneo · Sava Osiguranje customer database, one of Serbia's largest insurers, per the underground forum claim. No systems or versions cited in the source.
- Exploitation
- No technical exploitation indicated. Alleged sale on an underground forum, reported by DailyDarkWeb. Claim not independently verified and Sava Osiguranje has not confirmed an incident.
- Fix
- Not applicable: alleged data breach disclosure, with no vulnerability or fix cited in the source.
- More details
- Dataset alleged by the actor: JMBG (unique master citizen numbers), full names, gender, dates and places of birth, personal ID/registration numbers and tax IDs, mobile and landline numbers, emails, home addresses, policy data (numbers, products, status and dates, premiums, paid and overdue amounts), vehicle data (make, model, year, VIN, licence plate), driver's licence numbers, IBANs and bank names. The source assesses the set would enable identity fraud and convincing fake renewal, claim and overdue-payment messages. The actor addresses customers directly ('your data has been compromised'), a common pressure tactic. The underlying source is subscribers-only, per DailyDarkWeb.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
