Football Association of Serbia database breach leaks 11,000 athletes' data

Hackers have breached the database of the Football Association of Serbia (FSS), compromising the personal data of more than 11,000 athletes from Serbia and around the world. The breach reportedly began in April 2026 when hackers sent an email to the FSS, gaining access to sensitive information.

After failing to secure a ransom payment from the association, the perpetrators published the stolen data on a dark web forum. The compromised information includes details of high-profile Serbian football players such as Aleksandar Mitrović and Dušan Tadić, as well as prominent basketball players including Bogdan Bogdanović and Nikola Milutinov. Many of the affected individuals had previously stayed at the Srbija Luks hotel within the FSS sports center in Stara Pazova.

A man was arrested in late August by the Belgrade Higher Public Prosecutor's Office on suspicion of unauthorized access to the database. While the FSS stated they took measures to protect those compromised, many athletes and coaches reported they were never officially notified of the theft. Furthermore, the obligation to inform the Commissioner for Personal Data Protection has reportedly not been fulfilled.