Eko-Flor Plus d.o.o. listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Croatia
• Sector: Agriculture and Food Production
• Announcement date: July 10, 2026

Eko-Flor Plus d.o.o. targeted by Deadlock ransomware group

The Deadlock ransomware group has listed the Croatian organization Eko-Flor Plus d.o.o. on its dedicated leak site. According to the announcement made on July 10, 2026, the group claims to have successfully exfiltrated data from the company's networks. This development marks a significant incident for the Croatian waste management sector, as the group has begun publishing information they allege belongs to the organization.

Details of the claimed data breach

The information provided by the Deadlock group indicates a substantial volume of stolen information. The group claims to have obtained approximately 122 GB of data from the victim's infrastructure. This data is reportedly organized into nine separate archive files. Based on the available screenshots, the distribution of these files includes eight archives that are approximately 14.65 GB each, and one remaining archive measuring 4.79 GB.

While the volume of the data is clearly stated, the specific nature of the files remains unknown. The listing does not disclose the exact contents or the specific types of files contained within these archives. Consequently, the exact categories of information that have been compromised cannot be determined at this time.

About Eko-Flor Plus d.o.o.

Eko-Flor Plus d.o.o. is a major player in the Croatian industrial landscape. It holds the position of the largest private waste management company in Croatia. The organization specializes in several critical environmental services, including the collection, sorting, and processing of both municipal and non-hazardous waste.

Analysis and potential implications

The scale of the alleged leak suggests that sensitive information regarding the company's operational and administrative processes may have been exposed. Because Eko-Flor Plus d.o.o. operates within Croatia, a member state of the European Union, the company is subject to strict data protection obligations under the General Data Protection Regulation (GDPR). If the leaked data contains personal information belonging to employees or customers, it could create significant risks, such as identity theft or the execution of targeted phishing attacks against the individuals involved.

Furthermore, given the company's prominent role in the waste management sector, the breach could lead to potential indirect impacts on the broader supply chain. The tactics employed by the Deadlock group appear to follow a double extortion strategy. In such a scenario, threat actors do not merely encrypt a victim's systems to demand a ransom for decryption; they also steal sensitive corporate data to use as leverage, threatening to publish it publicly to force payment.

Publicly available information regarding the Deadlock group remains limited. In general, organizations facing such threats are encouraged to implement robust defensive measures. These typically include maintaining offline backups, implementing multi-factor authentication across all systems, and conducting regular security awareness training to mitigate the risk of initial access through phishing. In the event of a confirmed breach, organizations must follow established incident response protocols and fulfill their legal notification requirements to regulatory bodies and affected parties.