ANKERSKA PLOVIDBA d.d. listed on ElDorado ransomware leak site

• Ransomware group: ElDorado
• Country: Croatia
• Sector: Transportation
• Announcement date: November 18, 2024

The ElDorado ransomware group has listed the Croatian organization ANKERSKA PLOVIDBA d.d. on its dedicated leak site. According to the announcement made by the threat actor, the group claims to have conducted a cyberattack against the organization's systems. This listing follows a period of time since the alleged attack, as the group claims the initial intrusion occurred on February 11, 2024.

The details of the claim

The threat actor known as ElDorado officially announced the targeting of ANKERSKA PLOVIDBA d.d. on November 18, 2024. While the group has publicly claimed responsibility for an attack against the organization's infrastructure, the announcement remains largely devoid of specific technical details. The group has not disclosed the nature of the data they claim to have acquired, nor have they provided any information regarding a specific ransom demand or the volume of files involved in the incident.

In modern ransomware operations, groups often utilize leak sites to apply pressure on victims through a tactic known as double extortion. In such scenarios, attackers not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information on public forums if a ransom is not paid. This method aims to leverage the threat of data exposure to coerce payment. However, in this specific instance, the group has not provided any screenshots or specific evidence to support their claims of a successful breach.

Data and information involved

Regarding the contents of the alleged breach, the announcement provides no specific details. The listing does not name any specific data types that have been compromised, and no screenshots were provided by the threat actor to demonstrate the contents of the stolen information. Consequently, the exact scope of the data involved remains unknown at this time.

About ANKERSKA PLOVIDBA d.d.

ANKERSKA PLOVIDBA d.d. is a shipping and logistics company based in Croatia. The organization primarily operates within the fields of maritime services and the transportation of bulk cargo. As a player in the transportation sector, the company's operations are central to maritime logistics and supply chain activities.

Potential risks and organizational implications

This incident may pose significant risks to the organization's operational continuity and data privacy. Depending on the type of data allegedly leaked, there is a possibility that identity theft or targeted phishing attacks against employees or business partners may be observed. Such social engineering attacks often follow data breaches, as attackers use stolen credentials or personal information to gain further access or to deceive individuals within the supply chain.

Because the organization is based in Croatia, the incident may trigger specific legal and regulatory considerations. Data breach notification requirements and administrative sanctions under the General Data Protection Regulation (GDPR) may be relevant to this situation. Organizations facing such threats often find it necessary to initiate forensic investigations to verify the validity of potential data leaks and to fulfill their obligation to inform relevant regulatory authorities.

In the broader context of the transportation and logistics sector, maintaining robust cybersecurity postures is essential for protecting operational integrity. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting continuous monitoring of network traffic to detect unauthorized access. Given that public information about the ElDorado group is limited, organizations must remain vigilant against the evolving tactics used by such threat actors.