Zagreb Court Rejects 20,000 Euro Bail for Novi Sad Hacker
A Zagreb court turned down 20,000 euros in bail and a mortgage on his mother's house, so the Novi Sad hacking suspect stays in pretrial detention. His defense has appealed, with no ruling yet.
An offer of 20,000 euros plus a mortgage on a family house in Novi Sad was not enough to open the door of the detention unit. The hacker from Novi Sad, as Croatian investigators refer to him in the case involving breaches of state systems, remains behind bars after a Zagreb court rejected the proposal. The suspect is Georgije V. (33), the owner of a small Novi Sad software company, and investigators are separately checking whether his work could be linked to Serbia’s Security Information Agency (BIA). That suspicion has not been officially confirmed and the case is still under investigation, but the mere fact that a Zagreb courtroom is weighing the question of a Serbian intelligence service pushes the case out of pure cybercrime and into the diplomatic channel between Belgrade and Zagreb.
We have already reported that the trail from the breach of Croatian institutions led to Novi Sad. Since then, three new details have emerged: the court rejected the bail offer, a list of the targeted systems has come out, and the suspect was attacked inside the detention unit.
Bail, a Mortgage, and Three Grounds for Detention
The court ordered one month of pretrial detention on three grounds: risk of flight, the possibility of tampering with evidence, and the risk of reoffending. The second ground carries the most weight in a case like this, since the suspect works professionally in computer security and, in investigators’ assessment, would know how to erase traces and alter data relevant to the case.
After assurances that he would not leave Croatia failed to persuade the court, the defense offered money and property instead. Bail of 20,000 euros and a mortgage on a house in Novi Sad, which the suspect says belongs to his mother, were not enough of a guarantee for the court. His defense has appealed the detention order, and no ruling has been issued yet.
“An appeal has been filed against the ruling ordering pretrial detention, since we believe not all the legal conditions for such a decision have been met. At this point I cannot disclose details of the defense, because the proceedings are at an investigative stage that is confidential. I can only say that we will pursue every legal avenue to protect our client’s rights and interests, and to ensure the case is handled strictly in accordance with the law and the evidence,” said Nera Gajdarov Beg, the suspect’s attorney.
Since the investigation is confidential, neither the content of the appeal nor the deadline for the court’s ruling has been made public.
Which Institutions Were Targeted?
According to Croatia’s Cybersecurity Service, part of the Criminal Police Directorate, unauthorized access was gained to the systems of:
- Croatia’s Interior Ministry
- the Tax Administration, part of the Finance Ministry
- HZZO and HZMO, the health and pension insurance institutes
- REGOS, the insured persons registry
- HAKOM, the telecommunications regulator, and HAK
- the e-Citizens platform, accessed through the NIAS system
The list spans health, tax, and pension records, essentially the databases holding data on nearly the entire population of a country. Access to the e-Citizens platform was not gained through hacking but through a purchase: according to the investigation, the suspect obtained login credentials from a private individual in Croatia, which turns the case from an outside attack into one with an accomplice inside the country itself.
Swedish Servers, Serbian IP Addresses
Servers abroad, including in Sweden, were used to conceal his identity, but part of the access was traced to IP addresses in Serbia. That inconsistency is likely the reason the investigation was able to reach a name at all.
The timeline that emerges from stitching the dates together says more than the list of targets alone. The breach of Croatia’s Interior Ministry system happened on April 1, and the ministry only noticed the uninvited guest twelve days later. While police were still tracing the IP addresses used to access that system, a report came in from the Tax Administration about intrusions between April 28 and 30. In other words, the second wave of breaches took place while the investigation into the first was already underway.
The suspect described to investigators a company with several employees, even though official records show only one. Croatian investigators believe that description was an attempt to shift responsibility onto alleged associates. He also stated that Belgrade’s Special Court convicted him in 2012 for unauthorized access to a protected computer, meaning Croatian prosecutors are not dealing with a man without a record.
Attack Inside the Crnomerec Detention Unit
In the holding facility of the Zagreb Police Administration, in the Oranicki annex in Crnomerec, he was attacked at around 5:55 a.m. on July 30 by a 22 year old with whom he shared the room. Police officers responded immediately, and the attacker, according to the Zagreb Police Administration, “stopped the attack once they entered the room.”
The injured man was taken to Sveti Duh Clinical Hospital, where he received medical treatment; the severity of his injuries was not classified at the time. The incident adds another argument for the defense, but it did not affect the detention ruling.
Why the Case Has Become a National Security Issue
He was arrested on the early afternoon of July 28 in a tourist town on the Croatian coast, where he had driven a few days earlier for a vacation. The arrest took place in front of his wife, two minor children, and his mother. Acting on court orders, police searched his vehicle, premises, and devices, seizing two mobile phones, a laptop, and other digital data now headed for forensic examination.
He is charged with serious criminal offenses against computer systems, programs, and data. If it turns out that access to Croatian citizens’ data was commissioned, the case out of Zagreb would take on a weight that an individual act of cybercrime does not carry, and Belgrade would face a question no statement can easily answer. For now, no such link has been established, and officials are speaking only of an individual suspect.
The one month ordered by the court runs out toward the end of August, when prosecutors will either have to seek an extension or move the case into its next phase. Until then, the answer rests with the forensic examination of two phones and one laptop.
