Government of Vojvodina Data Breach

The Panzer ransomware group has claimed the Government of Vojvodina, the autonomous provincial government of Serbia, as a victim, listing its domain vojvodina[.]gov[.]rs on their leak site on August 24, 2026. This entity is responsible for administering one of Serbia’s two autonomous provinces, managing critical administrative functions that rely on continuous digital operations. The targeting of a regional government at this level presents a significant risk of operational disruption, extending beyond the impact typically seen with a private-sector victim of similar size. Over the past 60 days, Panzer has claimed 16 victims, predominantly targeting the Technology, Manufacturing, and Government & Defense sectors. Their primary geographic focus includes Serbia, Italy, and Indonesia. The group has demonstrated a consistent pattern of targeting Serbian organizations across both public and private sectors, making the Government of Vojvodina one of their more notable claimed victims due to its organizational profile. Other comparable victims attributed to Panzer include Castilla La Mancha, Senvibe, Nteitalia, and Frisian Flag Indonesia.

SOCRadar’s stealer-log telemetry did not return any records for vojvodina[.]gov[.]rs within the queried data slice. It is important to note that government entities often implement stringent access controls, which can limit the exposure of credentials in commercial stealer-log feeds. However, this does not rule out the possibility of credential exposure through personal email aliases used by government employees or via contractor access systems, both of which are typically outside the scope of such queries. Panzer likely utilized credentials obtained from infostealers as an initial access vector, a common tactic employed by ransomware operators targeting government institutions. Initial Access Brokers (IABs) often source fresh logs, validate credentials for VPN or remote-access portals, and establish a foothold before deploying ransomware. For a provincial government that maintains public-facing administrative portals and relies on contractor access, the external attack surface can be considerably broader than that of a standard corporate environment, especially if shared IT infrastructure with municipal bodies is involved.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.