When “just a name and an e-mail“ becomes much more:

When news broke that personal data linked to more than half a million students and
teachers had been exposed through the Croatian academic network CARNET, the first
public reaction was surprisingly calm.

Introduction

No passwords or financial information, just names, e-mail addresses, schools and user
roles. At first glance, it doesn’t sound like a catastrophic breach. From a social
engineering perspective, however, this kind of dataset is far more valuable than many
people realize.

The investigation

The incident began with a post on the DarkForums forum advertising a database titled
“Croatian Students Database”, allegedly containing 954.000 records. After removing
duplicate e-mail addresses, the dataset was found to include 563.509 unique records
from 1.452 Croatian educational institutions. Journalists verified that the leaked
information was authentic, containing users’ names, official @skole.hr e-mail
addresses, school names, and roles (student or teacher). The absence of data for the
youngest primary school students suggests either that the leak originated from a
connected application where school accounts become active only in later grades, or
from an older system backup.

In response, CARNET confirmed it is conducting a technical and forensic investigation to
determine the authenticity, scope, and origin of the leak, stating that there is currently
no evidence that user accounts have been compromised or that passwords need to be
changed. Meanwhile, Croatia’s Ministry of Science and Education is working closely with
CARNET, while the Croatian Personal Data Protection Agency (AZOP) has launched an
urgent investigation to assess whether GDPR obligations were met and whether thirdparty applications may have contributed to the incident.

The official investigations are still ongoing.

Social engineering doesn’t begin with passwords

Most people associate cybercrime with stolen credentials. Attackers often think
differently. Their first objective is context: who the person is, where they work, who they
communicate with and who they are likely to trust.

A dataset containing real names, verified school e-mail addresses and institutional
affiliations answers several of those questions immediately.

AI changes the economics of phishing – AI can enrich leaked e-mail addresses with
publicly available information from social media, school websites and other sources.
Large language models then generate highly convincing spear phishing e-mails in
seconds.

Schools deserve special attention because educational institutions operate on trust.
Students expect e-mails from teachers, teachers expect requests from administrators,
parents expect communication from schools. An attacker only needs to imitate that
communication convincingly.

Social engineering doesn’t begin with passwords

Voice cloning, deepfakes and automated OSINT all reduce the effort required to prepare
a targeted attack. None of these technologies require stolen passwords, but trust.
The danger isn’t in one leak – the real risk comes from combining multiple datasets. A
school e-mail from one breach, a phone number from another, public LinkedIn
information and social media activity together can create an extremely detailed profile.
AI excels at connecting those dots.

What should users do?

Avoid panic, but don’t ignore the incident. Treat unexpected e-mails with caution, even if
they contain accurate personal information (the usual “think before you click“
paradigm). Verify unusual requests through another communication channel and
remember that personal information is often used to establish trust before an attack
begins.

Forensic investigators will determine what happened. From a defender’s perspective,
another question matters just as much: how will this information be used months or
years from now?
Data breaches rarely create immediate damage, they create opportunities, and AI
increasingly amplifies those opportunities