Seven days ago, information emerged that a hacker group had published a dataset of Telekom Srbija users online, along with a threat to release everything unless the company paid a ransom.
That initial dataset contained around 160,000 records. Telekom responded with a statement saying that it concerned “a smaller portion” of data belonging to users of the m:SAT TV satellite service.
It turned out that more than 600,000 records had been stolen, and Telekom filed a criminal complaint with the special department for combating high-tech crime at the Higher Public Prosecutor’s Office.
The database stolen by the hackers contains exactly 688,884 entries, although not every entry corresponds to a separate individual, and the database includes 338,934 unique personal identification numbers. The data in the database was collected from January 2019 to December 2025.
“The database was created through the operational work of field technicians and call centres – every interaction with a subscriber during installation, servicing or contract termination left a trace. The data was distributed through a network of partners and subcontractors across Serbia,” according to an analysis by the SHARE Foundation.
The organisation points out that the database does not contain only names and contact details of Telekom users, but also personal and technical information forming detailed subscriber profiles.
Some of the data is permanent and cannot easily, or at all, be changed, thus posing a lasting risk. According to the analysis, these include personal identification numbers (JMBG), exact addresses, and mobile phone numbers. Notably, mobile phone numbers appear in 653,680 entries.
What also makes this database risky for fraud is free-text operator comments, present in 236,060 entries. These comments include information about users’ health conditions or habits. Examples include comments such as: “the user is at home until 3 pm”, “the user has postponed indefinitely due to a serious health condition of the child”, or “user in hospital, son abroad, call in about 10 days”.
It is also concerning that the database contains data, including personal identification numbers, of individuals who did not have a contract with Telekom. If a subscriber had died or transferred a contract, operators would enter the personal ID number of an heir or family member – a person who had never signed any contract.
There are 4,163 notes about deceased subscribers and 1,123 personal ID numbers of third parties in these comments. The analysis also identified 5,061 comments about subscribers’ movement schedules and 345 notes regarding health conditions. The database covers the period from January 2019 to December 2025, with more than 168,000 entries originating from 2025 alone.
Most of the data comes from Belgrade, with 82,607 entries, but the data covers almost the entire territory of Serbia, namely 151 municipalities.
The leaked database also contains data on companies and business users, as well as data from state institutions such as the Ministry of the Interior, the Ministry of Defence, the Serbian Armed Forces, and public utility companies, while the leaked data includes addresses, contact details and personal ID numbers of responsible individuals within these institutions.
With all this information, attackers can create convincing scams, primarily phishing, and the analysis concludes that the combination of personal ID number, address, and full name is sufficient to open bank accounts or take out loans in someone else’s name, i.e. to commit identity theft.
Political misuse is also possible, as a geolocation-precise database is ideal for targeted propaganda or voter manipulation. Finally, exact addresses, apartment numbers, and movement schedules may also endanger the physical safety of subscribers.
The SHARE Foundation advises citizens to be cautious of unexpected calls and messages, especially those requesting personal data or payments, even if they sound convincing.
(Danas, 24.03.2026)