Eko-Flor Plus d.o.o. Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
A ransomware attack by the Deadlock group on Eko-Flor Plus d.o.o. on July 10, 2026 resulted in the exfiltration of internal files. Individuals who may have shared data with the company should check for notifications and take protective steps.
What happened
The incident centres on a ransomware operation in which files were removed from Eko-Flor Plus d.o.o. systems before encryption. The Deadlock group placed the company on its leak-site listing, an action the group uses to pressure victims. No further details on the date of the intrusion, the volume of data taken, or the precise method of initial access have been made public.
Inside Deadlock
Deadlock is a ransomware group that conducts double-extortion attacks: data are first copied from the target network and the systems are then encrypted. The group maintains a public site where it lists organisations that have not met its demands, publishing samples or directories of the material it claims to hold. Such listings are presented by the group itself and remain unverified by independent sources unless the affected organisation confirms them.
About Eko-Flor Plus d.o.o.
Eko-Flor Plus d.o.o. is described as Croatia’s largest private waste-management firm. It is headquartered in Oroslavje and handles the collection, sorting and processing of municipal and non-hazardous industrial waste. Companies in this sector maintain records that include customer contracts, operational logs, vehicle and route data, and regulatory compliance documentation.
What data was at risk
The listing refers only to “internal files” that were allegedly exfiltrated. The precise categories of information contained in those files have not been published. Waste-management operators routinely store personal data linked to service accounts, billing information, and site-access records; however, whether any such data were among the material taken in this case remains unconfirmed.
Why it matters
Exposure of internal operational files can reveal details about collection schedules, customer bases and compliance processes. If personal identifiers are present, individuals may face risks of targeted fraud or unwanted contact. For the organisation, the incident adds the costs of investigation, potential regulatory scrutiny under Croatian and EU data-protection rules, and the need to restore systems without reintroducing the same access paths.
Were you affected?
Individuals who have held accounts or contracts with Eko-Flor Plus d.o.o. should watch for unusual activity on associated email addresses and financial accounts. Organisations that process personal data are required to notify supervisory authorities and, where required, the individuals concerned when a breach is likely to result in a high risk to rights and freedoms. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in previously published lists, though it cannot confirm presence in this specific incident.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
ADM Value Barcelona Listed by Deadlock Ransomware GroupUfoc Listed by Deadlock Ransomware GroupGlobal Terminal Services Listed by Deadlock Ransomware GroupPasello Listed by Deadlock Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Eko-Flor Plus d.o.o. Listed by Deadlock Ransomware Group →
Publicly posted by deadlock — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.