Port of Rijeka listed on 8base ransomware leak site

• Ransomware group: 8base
• Country: Croatia
• Sector: Transportation
• Announcement date: December 6, 2024

The 8base ransomware group has officially listed the Port of Rijeka on its dedicated leak site. According to the group's announcement, they claim to have published sensitive data belonging to the organization, marking a significant development in the ongoing threat landscape facing the transportation sector.

Details of the alleged attack

The threat actor behind the 8base group has indicated that the unauthorized access to the organization's systems occurred on November 30, 2024. Following the initial breach, the group has initiated a countdown process regarding the publication of the mentioned data, a common tactic used by ransomware groups to exert pressure on their targets.

Ransomware leak sites serve as a platform where cybercriminals host stolen information to shame organizations into paying ransoms. This practice is often part of a broader strategy known as double extortion. In a double extortion scheme, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to leak it publicly if the ransom is not met. This approach increases the leverage of the attacker, as the victim faces the threat of regulatory penalties and reputational damage even if they can restore their systems from backups.

Data types involved in the leak

While the specific volume and count of the files have not been disclosed by the group, the information available on the leak site suggests a wide variety of sensitive documents have been targeted. The group claims that the stolen data includes a range of administrative, financial, and personal files, which may include:

• Invoices
• Receipts
• Accounting documents
• Personal data
• Certificates
• Employment contracts
• Confidentiality agreements
• Various personal files

The exposure of such diverse documentation suggests a deep penetration into the organization's internal administrative and human resources systems.

About the Port of Rijeka

Luka Rijeka d.d. is the largest concessionaire for dry cargo handling and storage in the Port of Rijeka basin in Croatia. The company provides a wide array of essential services, including maritime transport, port services, cargo storage, and the maintenance of critical port equipment and infrastructure. As a major player in the regional logistics network, the organization plays a vital role in the economic and maritime operations of the Croatian coast.

Risk assessment and implications

The alleged data leak poses several significant risks to the organization, its employees, and its business partners. The presence of personal data, employment contracts, and certificates in the hands of threat actors creates a high risk of identity theft and targeted phishing attacks. Such attacks often use the stolen personal information to craft highly convincing messages designed to deceive employees or partners into revealing further credentials or transferring funds.

Furthermore, because the organization operates within Croatia, it is subject to the strict data protection regulations established by the EU GDPR. This means the organization may face rigorous investigations regarding its ability to fulfill its data protection obligations. Beyond regulatory concerns, the potential exposure of trade secrets or sensitive operational information could negatively impact the organization's competitive position in the maritime and logistics industry.

The 8base group has been active since 2022 and is known to utilize Phobos-variant encryptors. Despite operational interventions carried out in early 2025, the group is assessed to be continuing its operations. For organizations in the transportation and logistics sector, such incidents underscore the necessity of robust defensive measures, including multi-factor authentication, regular security audits, and comprehensive employee training to mitigate the risks of both initial access and subsequent data exfiltration.