Croatian authorities have arrested a 33 year old Serbian citizen in Zagreb on suspicion of carrying out sophisticated cyberattacks against the computer systems of multiple Croatian state institutions. Investigators are also examining possible links between the suspect and Serbia’s Security Intelligence Agency, known as BIA, although no official confirmation of such a connection has been made.
The State Attorney’s Office in Zagreb announced on July 30 that it had questioned the suspect, who was born in 1993, over alleged offenses involving computer systems, programs and data, as well as the unauthorized use of personal information. Prosecutors requested pre trial detention, citing concerns over potential flight, interference with the investigation and the possibility of further offenses. The Zagreb County Court approved the request, and the suspect was placed in detention.
According to prosecutors, there is well founded suspicion that the accused concealed his identity and location while using techniques designed to enable anonymous access to computer systems. Investigators believe he gained unauthorized access to the systems and data of several public institutions and companies established by the Croatian state during 2026.
Croatian police said that, acting under court orders, investigators searched properties, vehicles and electronic devices during the investigation. Authorities seized equipment and digital data that could be relevant to the alleged offenses. The arrest comes after several Croatian institutions reported cyberattacks in recent months, although officials have not established whether those incidents are connected to the Serbian citizen’s case.
Possible BIA Connection Adds Geopolitical Tension
The Serbian hacker arrest has taken on a broader geopolitical dimension because of reports that investigators may have traced elements of the cyber operation back to Serbia. Serbian outlets reported that the intrusions began in early April 2026 and that Croatia’s Interior Ministry discovered the breaches several months later.
According to those reports, investigators traced parts of the attack infrastructure to a cybersecurity company in Novi Sad, Serbia, while some servers were reportedly located in Sweden. Such arrangements can make it difficult for investigators to determine who is ultimately responsible for a cyberattack, as infrastructure and servers may be located in different countries from the people operating them.
Reports circulating on social media have also alleged that Croatian investigators suspect the detained man could have connections to Serbia’s BIA. Those claims have not been officially confirmed by Croatian or Serbian authorities, so the alleged intelligence connection remains an unproven aspect of the investigation.
The case comes against a backdrop of longstanding tensions between Croatia and Serbia. The two countries fought during the wars of the 1990s and continue to face disagreements involving minority rights, historical issues and other bilateral disputes. Both countries are also navigating their relationships with the European Union, adding another layer of political sensitivity to any potential cross border espionage case.
Serbia’s BIA has previously been involved in espionage related allegations in the region. In August 2024, the agency announced the arrest of a person it described as a suspected Croatian spy, while Croatian authorities said they had no knowledge of the case. If investigators eventually establish that the Zagreb cyberattacks were connected to a Serbian intelligence operation, the incident could become one of the most serious alleged cyber espionage cases between the two countries in recent years.
For now, the suspect remains in pre trial detention while Croatian investigators examine the seized electronic evidence and attempt to determine the full scope of the alleged attacks. The investigation will ultimately have to establish whether the case involves an individual acting independently or a broader organized operation, including whether any state institution was involved.
