Port of Rijeka Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out operators of ports, logistics hubs and other critical infrastructure, treating operational systems and internal records as leverage for double-extortion campaigns. Against that backdrop, the Port of Rijeka appeared on a ransomware leak site in late 2024, an event that has drawn attention because of the organisation’s central role in Croatian maritime cargo handling.

On 30 November 2024 the Port of Rijeka – Luka Rijeka d.d. – was listed by the 8base ransomware group. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected remains unknown and further technical detail has not been released.

Breaking down the breach

According to available records, the incident was reported on 30 November 2024 under the headline that the Port of Rijeka had been listed by the 8base ransomware group. The only data category named is “internal files exfiltrated in a ransomware attack.” No confirmed figure for the volume of data, no list of specific file types, no statement of whether systems were encrypted, and no disclosure of the initial access method have been made public. The number of individuals whose information may be involved is recorded simply as unknown. Because the listing itself originates from the threat actor’s site, it must be treated as a claim rather than independently verified fact until further confirmation appears.

The group behind it: 8base

8base is a ransomware operation that has been active in public reporting since 2022–2023. Like many contemporary groups, it is associated with a double-extortion model: data is stolen before encryption, and victims are threatened with publication on a dedicated leak site if a ransom is not paid. The group typically recruits affiliates, uses common initial-access techniques such as phishing or exploitation of exposed remote services, and maintains a Tor-based blog where it posts victim names and sample files. Prior listings have included companies across manufacturing, professional services and logistics. In the present case the group claims to have listed the Port of Rijeka and to have taken internal files; no additional statements specific to this victim beyond that listing have been corroborated in the public record.

Who is Port of Rijeka?

The Port of Rijeka – formally Luka Rijeka d.d. – is described as the largest concessionaire for shipping and the reload of dry cargo in the Rijeka port basin. Under its concession agreement it provides maritime-traffic services, port handling, storage of cargo at specialised terminals, and a range of supporting economic activities: maintenance of port machinery and equipment, upkeep of substructure and superstructure buildings, reinforcement, packaging and securing of loads, and quality and quantity control of goods. As a major Adriatic gateway, the port sits inside regional supply chains that move bulk commodities, containers and industrial materials. Organisations of this type routinely maintain operational schedules, cargo manifests, commercial contracts, employee records and partner contact data; a disruption or data exposure can therefore affect not only the port itself but also shippers, freight forwarders and downstream industries that rely on its terminals.

The information in question

The sole category named in public reporting is internal files obtained during a ransomware attack. Exact contents have not been disclosed. Ports and terminal operators typically hold operational documents, commercial correspondence, employee and contractor information, and technical records related to equipment and infrastructure. Whether any of those categories were among the files claimed by 8base remains unconfirmed. No inventory of personal data fields, financial records or system credentials has been released, so any assessment of sensitivity must remain general rather than specific to this incident.

The real-world impact

For the organisation, the principal risks are operational interruption, potential regulatory scrutiny, and the need to investigate and remediate whatever access path was used. For individuals whose data may have been among the internal files, the concrete concerns are identity misuse, targeted phishing that references port-related details, and the possibility that commercial or personal contact information could be reused in further social-engineering attempts. Because the scale of the exposure is unknown, the practical impact cannot yet be quantified; the prudent stance is to treat the claim seriously while awaiting clearer confirmation of what was taken.

If your data was in this claimed breach

Until more detail emerges, people who have worked with or for the Port of Rijeka, or who have had cargo or commercial dealings there, can take a small set of practical steps:

• Monitor bank and credit accounts for unfamiliar activity and enable transaction alerts where available.
• Treat unexpected emails or calls that reference port business, invoices or personal details with caution; verify through known official channels before responding.
• Change passwords on any accounts that may have reused credentials linked to work or partner portals, and enable multi-factor authentication wherever it is offered.
• Keep copies of important documents offline and note any unusual requests for identity or payment information.
• Run a free exposure scan of your email address to check whether that address has already appeared in other known breach data sets; this does not confirm involvement in the present incident but can surface earlier exposures that warrant attention.

Public information on this event remains limited. Further official statements from the port or from independent investigators would be required before the full scope can be established. In the meantime the measured response is awareness, basic hygiene, and continued monitoring rather than alarm.

AICompiled with AI assistance from public sources and published under our editorial standards.