rao.hr Listed by apt73 Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On November 20, 2024, the Croatian organisation rao.hr was listed by the ransomware group apt73, which claimed to have carried out a ransomware attack that included the exfiltration of internal files. Public detail remains limited: the number of people affected is unknown, and no further technical timeline or confirmed volume of data has been released. The listing itself is a claim by the group rather than an independently verified confirmation of every asserted detail.

For anyone who has dealt with the company—customers, employees, partners or suppliers—the incident matters because internal files can contain operational records and personal information that create lasting practical risks even when exact contents stay undisclosed.

What happened

According to the available record, rao.hr (also identified as RAO d.o.o.) was listed by apt73 on November 20, 2024. The group described the incident as a ransomware attack in which internal files were allegedly exfiltrated. No public information has been provided on the precise date the intrusion began, the initial access method, the encryption status of systems, or any ransom demand. The scale of the event—how many systems were involved or how many individuals may be affected—is listed as unknown. Beyond the group’s claim that internal files were taken, further specifics about the attack chain remain undisclosed.

The group behind it: apt73

apt73 is a ransomware operation that has appeared in public threat reporting as a group that encrypts victim systems and simultaneously steals data for leverage. Like many contemporary ransomware actors, it typically maintains a leak site on which it names organisations and asserts that data has been exfiltrated, using the threat of publication to pressure payment. Public documentation of the group’s activity describes double-extortion tactics: encryption paired with data theft, followed by timed release of samples or full archives if negotiations fail. The group has been associated with opportunistic targeting across multiple sectors rather than a single industry focus. In the present case, apt73’s listing of rao.hr constitutes a claim that internal files were taken; that claim has not been independently corroborated in the public record supplied here, and no additional statements attributed specifically to this victim beyond the listing itself are available.

Who is rao.hr?

RAO d.o.o., operating as rao.hr, is a Croatian company that forms part of the Best in Parking AG group based in Austria. Public descriptions note more than a quarter-century of professional activity in its field. As a member of a parking-services group, the organisation is understood to manage parking facilities, related infrastructure and customer-facing services. Organisations of this type routinely process vehicle and payment data, employee records, contracts with municipalities or private operators, and internal operational documentation. A breach at such an entity is consequential because parking operators sit at the intersection of everyday consumer transactions and municipal or commercial infrastructure; any compromise of internal systems can affect both private individuals and partner organisations that rely on continuous, trustworthy service.

What was likely exposed

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file categories, volumes or specific data elements has been disclosed, and the number of people potentially affected remains unknown. Organisations engaged in parking management typically hold a range of records that could fall under the broad heading of “internal files.”

• Customer or user account details linked to parking sessions, subscriptions or payments
• Employee personnel and payroll information
• Contracts, invoices and correspondence with partners or public authorities
• Operational logs, facility plans and system configuration data
• Financial and administrative documents generated in the ordinary course of business

These categories represent what such an organisation commonly retains; they are not confirmed contents of the files claimed by apt73. Exact exposure remains unconfirmed.

What's at stake

For individuals whose information may have been among the internal files, the practical risks include targeted phishing that references genuine parking or employment details, attempts at identity misuse if personal identifiers were present, and potential financial fraud if payment-related records were involved. Because the precise data set is unknown, the severity for any single person cannot be quantified from public sources. For the organisation itself, the stakes include operational disruption, regulatory scrutiny under data-protection rules, contractual obligations to partners within the Best in Parking AG group, and the longer-term cost of restoring trust and securing systems. Even when encryption is reversed or systems are rebuilt, the existence of an exfiltrated copy of internal files creates an enduring exposure that cannot be fully recalled.

What to do if you're exposed

If you have had dealings with rao.hr—whether as a customer, employee or partner—treat the possibility of exposure seriously until more detail emerges. Change passwords associated with any accounts that may have been linked to the company, enable multi-factor authentication wherever available, and monitor bank and credit statements for unexpected activity. Be cautious of unsolicited messages that reference parking services, invoices or employment matters, as stolen internal data is frequently reused for social-engineering attacks. Keep records of any unusual contact and report confirmed fraud to the relevant authorities. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets; such a check provides an early indicator even when the full contents of a particular incident remain undisclosed.

AICompiled with AI assistance from public sources and published under our editorial standards.