ANKERSKA PLOVIDBA d.d. listed on Blacklock ransomware leak site

• Ransomware group: Blacklock
• Country: Croatia
• Sector: Transportation
• Announcement date: May 16, 2025

The Blacklock ransomware group has listed the Croatian shipping company ANKERSKA PLOVIDBA d.d. on its dedicated leak site. This announcement, made on May 16, 2025, indicates that the threat actor claims to be in possession of data belonging to the institution.

The details of the claim

According to the announcement posted on the group's platform, the threat actor known as Blacklock listed ANKERSKA PLOVIDBA d.d. on May 16, 2025. The group's communication method involves a specific channel via the encrypted messaging application Session, which has been provided for the institution to contact the group regarding the matter.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also threaten to publish sensitive information on public platforms if a ransom is not met. This pressure is designed to leverage the reputational and legal risks associated with data exposure to compel payment. While the group has published this listing, the specific circumstances surrounding the initial access or the timing of the breach remain unconfirmed by the victim.

Data involved in the listing

Regarding the specific contents of the alleged breach, the provided information does not contain any specific details regarding the nature of the leaked data. The listing names no specific data types.

In many ransomware incidents, the volume of data and the specific categories of information—such as financial records, employee identities, or proprietary logistics data—are later disclosed by the attackers to increase pressure. However, at this stage, no information has been provided regarding the size of the data or the total file count involved in this incident.

Organizational profile

ANKERSKA PLOVIDBA d.d. is a well-established Croatian shipping company specializing in the transportation of oil and chemical products. The company provides international energy logistics services with its fleet of tankers.

Implications and industry considerations

This situation may pose risks to the operational continuity of the institution. Because the organization is based in Croatia, a potential data breach could lead to legal consequences under the European Union's General Data Protection Regulation (GDPR). The exposure of employee or customer data could create a basis for identity theft or targeted phishing attacks.

Public information regarding the Blacklock group is limited; therefore, the group's methods and motivations cannot be fully determined. When dealing with such threats, organizations in the transportation and logistics sector often face unique challenges due to the critical nature of their supply chain roles. A disruption in shipping or logistics can have cascading effects on international energy supply chains.

To mitigate potential risks, it is generally advisable for institutions to review their data security processes and take necessary measures to minimize potential impacts. Common defensive steps for organizations include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.