Rovinj-rovigno.hr listed on Lockbit5 leak site following alleged data breach

• Ransomware group: Lockbit5
• Country: Croatia
• Sector: Hospitality
• Announcement date: March 30, 2026

The Lockbit5 ransomware group has listed rovinj-rovigno.hr on its leak site, alleging that the organization has been the victim of a data breach. The threat actors claim to have successfully gained access to the digital assets belonging to the organization, marking a significant escalation in their targeting of municipal entities.

Details of the alleged attack

According to the announcement made on the group's leak site, the incident involving rovinj-rovigno.hr is linked to an attack that allegedly occurred on March 16, 2026. The threat actors have publicly listed the organization, which includes information that is already available to the public. Furthermore, the group has initiated a countdown timer, a common tactic used by ransomware groups to pressure victims into meeting ransom demands before the stolen information is released to the public.

Ransomware groups often utilize these leak sites as a tool for double extortion. In such scenarios, attackers do not only encrypt an organization's data to disrupt operations but also threaten to publish sensitive information to coerce the victim into paying a ransom. The use of a countdown timer is a psychological tactic designed to increase the sense of urgency and panic within the targeted organization and its stakeholders.

Information regarding the leaked data

Regarding the specifics of the alleged breach, there is no information regarding the nature of the alleged leaked data in the provided records or the screenshot. The listing does not specify the types of files, the volume of data, or the specific databases that may have been accessed by the attackers.

Potential risks and implications

This incident may pose a risk to the organization's operational continuity and could result in the exposure of customer data. As an organization operating in Croatia, it may face data breach notification obligations under the GDPR regulations applicable across the European Union. The regulatory landscape in the EU requires strict adherence to reporting protocols when personal data is compromised to ensure transparency and mitigate harm to individuals.

Given the past methods of the Lockbit group, it is possible that the leaked data could be used in secondary attacks or identity theft attempts. Threat actors frequently repurpose stolen credentials or personal information to conduct phishing campaigns, business email compromise, or other fraudulent activities. Furthermore, the organization may experience reputational damage, and its supply chain partners may also be negatively impacted by this situation. Such incidents often require a coordinated response involving technical remediation, legal counsel, and public relations to manage the fallout and restore trust.

Organizational profile

Rovinj-Rovigno is a municipal administration located in the Istria region of Croatia. It manages the city's administrative affairs and oversees tourism activities in the region.

Defensive considerations for the sector

Organizations in the public and hospitality sectors often face unique challenges due to the high volume of citizen and tourist data they manage. To defend against such threats, organizations typically focus on implementing robust security frameworks. This includes maintaining strict access controls, implementing multi-factor authentication, and ensuring regular, offline backups of critical data. Additionally, continuous monitoring of network traffic and employee awareness training are essential components of a modern cybersecurity posture designed to detect and prevent unauthorized access before data can be exfiltrated.