ANKERSKA PLOVIDBA d.d. Listed by blacklock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

ANKERSKA PLOVIDBA d.d., a Croatian shipping company based in Zadar, was listed by the ransomware group blacklock on or around 18 November 2024. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and further technical details of the incident have not been disclosed.

The listing itself is a claim by the group rather than an independently verified confirmation. For a company whose operations involve cargo transport and related commercial records, any confirmed exposure of internal material carries practical consequences for the organisation and for individuals whose information may appear in those files.

What happened

According to available reporting, ANKERSKA PLOVIDBA d.d. was named on a blacklock leak site in connection with a ransomware attack in which internal files were taken. The incident was reported on 18 November 2024. No public figures have been given for the volume of data, the number of systems involved, or the precise method of initial access. The scale of the event and any ransom demand, if one was made, are undisclosed. What is stated is that internal files were exfiltrated as part of the attack.

Because the listing originates from the threat actor, it should be treated as an unverified claim until the company or independent investigators provide confirmation. No official statement from ANKERSKA PLOVIDBA d.d. detailing the timeline, containment steps, or forensic findings has been included in the material available for this account.

Who is blacklock?

Blacklock is a ransomware group known for double-extortion operations: encrypting systems while also stealing data and threatening to publish it on a dedicated leak site if payment is not made. Like other groups of this type, blacklock typically advertises victims with brief descriptions and sample files to increase pressure. Public reporting on the group’s broader activity shows a pattern of targeting mid-sized organisations across multiple sectors rather than a single industry focus.

In this case the group claims that ANKERSKA PLOVIDBA d.d. is a victim and that internal files were allegedly exfiltrated. No additional statements attributed specifically to blacklock about this company—such as exact file counts, financial demands, or deadlines—appear in the facts provided. Claims made on ransomware leak sites are routinely treated by investigators as assertions that require independent corroboration.

Who is ANKERSKA PLOVIDBA d.d.?

ANKERSKA PLOVIDBA d.d. is a shipping company headquartered in Zadar, Croatia. Established in 1957, its core business is marine cargo transportation conducted with a fleet of owned and chartered vessels. Services cover both domestic Croatian routes and international freight. The company is also active in the renting and leasing of real estate that it owns or leases.

Organisations of this kind routinely maintain operational records, commercial contracts, crew and staff information, vessel documentation, customer and supplier details, and financial data. A breach affecting such material can disrupt logistics, expose commercial relationships, and create compliance obligations under data-protection rules. Because the company operates across borders, any confirmed compromise may also involve counterparties and regulators outside Croatia.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. Exact contents, file volumes, and categories beyond that description have not been disclosed. Shipping companies typically hold a range of sensitive material; the following points summarise what is known and what remains unconfirmed:

• Confirmed claim: internal files were taken as part of the ransomware incident.
• Unconfirmed: specific document types, employee or customer records, financial statements, or vessel operational data.
• Unconfirmed: whether personal data of crew, staff, or third parties was included.
• Unconfirmed: total volume of data or any sample files published by the group.

Until the company or independent analysis provides a clearer inventory, the precise nature of the exposed material cannot be stated as fact.

The real-world impact

For individuals whose details may appear in the company’s internal files, the practical risks include unwanted contact, phishing attempts that reference legitimate business relationships, and potential misuse of any personal or financial information that was present. Because the number of people affected is unknown, it is not possible to quantify how many individuals face elevated risk.

For the organisation itself, consequences can include operational disruption while systems are restored, contractual notifications to partners and customers, regulatory scrutiny under applicable privacy laws, and reputational questions from clients who rely on the confidentiality of shipping and commercial arrangements. Real-estate leasing records, if involved, could also affect tenants or counterparties. None of these outcomes has been confirmed in public reporting; they represent the ordinary range of effects observed after similar ransomware incidents involving internal corporate data.

Were you affected?

If you have worked with, been employed by, or supplied services to ANKERSKA PLOVIDBA d.d., treat the possibility of exposure as open until more detail emerges. Practical first steps include monitoring financial and email accounts for unusual activity, changing passwords used in any shared systems, and remaining alert to messages that reference the company or its vessels. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Official updates, if released by the company or Croatian authorities, should be regarded as the primary source of confirmation.

AICompiled with AI assistance from public sources and published under our editorial standards.