Slovenian Government: Compromised Agency Web Server Exposes 15,000+ Domino Account Records

"Slovenia's Government Information Security Office (URSIV) has confirmed a breach of the state administration's information system. An attacker broke into a web server belonging to one government body and used it to pull…"

Slovenia's Government Information Security Office (URSIV) has confirmed a breach of the state administration's information system. An attacker broke into a web server belonging to one government body and used it to pull account data from the administration's Domino system. In a notice published on the government portal gov.si on 1 November 2026, URSIV said the attacker took more than 15,000 user records, and 7,216 of them contained hashed passwords. The affected server has been taken off the network. URSIV has told system administrators to reset the passwords on every affected account immediately. SIGOV-CERT, the government's incident response centre for state and local public administration, is still investigating. The figures are the same in every report: URSIV's notice, the government's post on X, and coverage by Delo, Siol.net, N1 Slovenija, Večer (using the national news agency STA) and the Uzbek outlet tafs.uz.

What Happened

URSIV disclosed the incident on Sunday evening, 1 November 2026. The government repeated it on its official X account, and Slovenian outlets had it within the hour. The official account is short. An attacker compromised a web server run by "one of the state bodies" and from there got unauthorised access to account data for the state administration. URSIV has not named the body that ran the server, said when the compromise started, or said how long the attacker had access before being detected.

URSIV's notice says the server was isolated from the network once the attack was detected. The responsible services are working to limit the damage, protect user accounts and prevent further misuse. SIGOV-CERT is analysing the incident with the relevant technical services. URSIV says it will publish significant new findings and any further required measures through official channels. Until then, affected users should follow instructions from the administrators of their own systems.

No group has claimed the attack. Officials have not named any suspect or said what the attacker wanted. Nobody has said publicly whether the data has appeared for sale or been leaked.

What Was Taken

URSIV describes the haul as "more than 15,000 user records from the Domino system." Of those, 7,216 contained password hashes. URSIV defines hashes as "mathematically processed values" used to store and check passwords, and warns that in some cases the original password can be recovered from them.

Some points are still unclear:

Records versus people. URSIV talks about user records, not individuals. Headlines such as tafs.uz's "more than 15,000 Slovenian civil servants" treat the two as the same thing. The count may include service accounts, old accounts or duplicates. URSIV has not said how many people are affected.
Other fields. The notice does not list what the records held besides the 7,216 hashes. Directory records of this kind usually hold names, usernames, email addresses, job titles and department details. That is enough to plan targeted phishing even without any passwords.
Hash strength. URSIV has not said which hashing algorithm was used or whether the hashes were salted. Domino deployments have used a range of password hash formats over the years, some older and weaker than others. How quickly passwords can be cracked depends on this, and it has not been disclosed.
Vendor. The sources say only "Domino." This is almost certainly HCL Domino, the collaboration and mail platform formerly called IBM Lotus Domino. URSIV has not confirmed that or given a version.

Why It Matters

Directory data is a map for the next attack. A list of more than 15,000 accounts across the state administration shows who works where, and in what role. That is the starting point for convincing phishing aimed at officials. Hashes that can be cracked make it worse: any recovered password that is still valid is a working login.

Password reuse spreads the damage. URSIV told users to change passwords on other work and personal services where they used the same or similar passwords. That advice shows the agency's main worry is credential stuffing, where a cracked government password is tried against VPNs, cloud services and personal email.

One agency's web server became a route into shared government systems. The attacker apparently started on a web server run by one body and reached account data for the whole administration. That points to too much trust, or not enough separation, between internet-facing servers at individual agencies and central identity or collaboration systems.

The timing invites a link that nobody has confirmed. Denarni Fokus reports that on 21 October, eleven days earlier, URSIV raised the national cyber threat level to high. The trigger was two critical PHP remote code execution flaws, CVE-2026-109618 and CVE-2026-109619, both scored 9.2 under CVSS v4.0. URSIV ordered organisations under the Information Security Act and government security operations centres to find internet-facing PHP applications and patch them urgently. Neither URSIV nor any other source has linked the Domino breach to these flaws. The vulnerable server's software stack has not been disclosed. Defenders should treat any connection as unproven, though it is worth checking for. Denarni Fokus also covered a reported data leak at the Serbian subsidiary of the insurer Sava Re. It noted that this leak was separate from the PHP flaws and is also unrelated to this incident.

Separately, Informer.si reports that the political party Gibanje Svoboda suspects documents with bank account details of several hundred citizens may have leaked from a secure room in the National Assembly. The party says it will report this to the police. That is an alleged insider disclosure, not a cyberattack. It has not been confirmed and has no stated connection to the Domino breach. It does add to broader public concern in Slovenia about how the state protects sensitive data.

The Attack Technique

The only confirmed detail is the entry point: a compromised web server operated by a government body. URSIV has not said:

How that server was compromised, whether through a software flaw, stolen credentials, a misconfiguration or a vulnerable web application.
How the attacker got from that server to the Domino records. It could have been network access to the Domino server, credentials stored on the web server, or a directory or replication link between the two.
Whether the attacker got past copying records, for example by logging in with cracked credentials, moving to other systems or leaving behind a way back in.

Two broad scenarios fit what URSIV has said. In one, the compromised server was a web front end that was itself connected to Domino, such as a Domino web server or a site built on it, and the attacker read the directory data directly. In the other, the web server was a foothold for reaching Domino over the internal network. These are working hypotheses, not findings. SIGOV-CERT's analysis is still going on.

What Organizations Should Do

Reset and enforce, don't just recommend. Force password resets on every account in the exposed set. Expire sessions and tokens tied to those accounts. Block reuse of earlier passwords. Look for logins on affected accounts from new locations or devices in the weeks before the reset.
Turn on multi-factor authentication for mail, collaboration and remote access. URSIV recommends MFA "where possible." Make it mandatory for webmail, VPN and admin interfaces, so that a cracked hash alone does not give anyone a working login.
Audit Domino password hashing and web exposure. If you run HCL Domino, check which password hash format your directory uses and move to the strongest supported option. Check which fields in the directory are readable by anonymous or low-privilege users, and limit access to the directory over HTTP. Patch Domino servers and the web servers in front of them.
Separate internet-facing web servers from central identity systems. A web server at one agency should not have broad network access to administration-wide directories or collaboration systems. Restrict traffic to the specific ports and services needed. Take stored credentials and directory bind accounts off web servers, or tightly limit their rights.
Finish the PHP patching URSIV ordered on 21 October. No link to this breach has been confirmed. Even so, the high threat level is still in force, and unpatched internet-facing PHP applications are a likely way in. Treat any server still unpatched as possibly compromised and investigate it.
Prepare staff for targeted phishing. Warn civil servants and contractors that messages using accurate names, roles and department details may follow this breach. Give them a quick way to report suspicious messages, and confirm any request for credentials or payment through a second channel.

Sources: Hacker steals data of more than 15,000 Slovenian civil servants' ac... | Kibernetski vdor v državno upravo, javni uslužbenci morajo zamenjat... | Kibernetski vdor v sistem državne uprave: napadalec pridobil več ko... | Hekerji vdrli v informacijski sistem državne uprave. Javni uslužben... | Po kibernetskem incidentu poziv k menjavi gesel v državni upravi. K... | So iz državnega zbora odtekali bančni podatki več sto Slovencev? Sv... | Slovenia Raises Cybersecurity Alert - Denarni Fokus | Nujna ponastavitev gesel zaradi kibernetskega vdora v informacijski...