stb.ro Listed by killsec Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On July 30, 2024, the Romanian public transport operator stb.ro appeared on a listing by the ransomware group killsec. The group claims it breached the organisation, exfiltrated internal files, and demanded a ransom of 5,000 EUR to wipe the stolen data. The number of people affected remains unknown, and independent confirmation of the full scope has not been publicly detailed.

For an operator responsible for public transit services in Romania, any claim of internal file theft raises immediate questions about operational continuity, employee and passenger data, and the reliability of systems that keep urban transport running. Public detail is still limited to the group's own statements and the reported listing.

Inside the incident

According to the available record, killsec listed stb.ro on July 30, 2024, stating that it had breached the organisation and taken internal files. The group further claimed that a ransom of 5,000 EUR would secure the deletion of the exfiltrated material. No technical method of intrusion, no timeline of the attack itself, and no verified volume of data have been disclosed beyond these assertions. The number of individuals potentially affected is recorded as unknown. Public reporting has not confirmed whether the ransom was paid, whether systems were encrypted, or whether the organisation has issued its own statement verifying or contesting the claims.

What is established is simply the listing itself and the group's description of the event as a ransomware attack involving exfiltration of internal files. Everything else—precise dates of access, systems compromised, or the current status of the data—remains undisclosed in the public record.

Inside killsec

Killsec is a ransomware group that has operated by claiming breaches of organisations, posting victim names on leak sites, and demanding payment in exchange for non-publication or deletion of stolen data. Like other actors in this category, it typically combines data theft with the threat of public release, a double-extortion model that has become common among ransomware crews. Public reporting over recent years has associated killsec with listings of various entities across sectors, often accompanied by modest ransom figures and claims of internal document theft.

In this case the group claims it breached stb.ro, described the target as Romanian public transport, and set a 5,000 EUR ransom for wiping the data. Those statements remain the group's own claims; they have not been independently verified in the facts available. Killsec's pattern of activity is well-documented in open sources, but no additional specifics about its operations against this particular victim have been confirmed beyond the listing and the ransom demand.

Who is stb.ro?

Stb.ro is the online presence of Societatea de Transport București, the public transport operator serving Romania's capital and surrounding areas. Organisations of this type manage bus, tram and metro services, ticketing systems, fleet logistics, employee records, and passenger-facing digital platforms. They routinely hold operational schedules, infrastructure details, staff information, and sometimes customer account or payment data linked to travel cards and online services.

A breach claim against such an entity is consequential because public transport systems sit at the intersection of critical infrastructure and large-scale personal data. Disruption or exposure can affect daily mobility for hundreds of thousands of residents, while any compromise of internal files risks revealing operational plans, employee details, or supporting systems that keep services running. The organisation's role as a municipal service provider means the potential impact extends beyond commercial loss to public trust and continuity of essential transport.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, databases, or specific categories of personal information has been disclosed. Organisations operating public transport typically maintain employee records, operational documents, network configurations, ticketing databases, and sometimes limited passenger or subscriber information. Whether any of those categories were among the files taken remains unconfirmed.

Because the exact contents are not named beyond "internal files," it is not possible to state with certainty what personal or operational data may have been exposed. The group's claim is limited to the fact of exfiltration and the ransom demand; independent inventories of the stolen material have not been made public.

Why it matters

For individuals whose information may have been among the internal files, the practical risks include potential misuse of personal details if employee or customer records were involved, and the longer-term possibility of phishing or social-engineering attempts that leverage any leaked context. For the organisation, the consequences centre on operational security, the integrity of systems that schedule and manage public transport, and the need to assess whether further unauthorised access remains possible.

Even when the volume of affected people is unknown and the precise data types unconfirmed, a ransomware claim against a public transport operator carries weight because of the sector's role in daily urban life. Any loss of internal files can complicate recovery, raise regulatory questions under data-protection rules, and require careful communication with staff and the public. The modest ransom figure does not diminish the seriousness of the alleged exfiltration; it simply indicates the scale of the demand as stated by the group.

What to do if you're exposed

If you have any connection to stb.ro—as an employee, contractor, or user of its services—monitor accounts for unusual activity and treat unexpected messages that reference the organisation with caution. Change passwords on related services, enable multi-factor authentication where available, and remain alert for phishing that might exploit knowledge of the incident. Because the number of people affected and the exact data types remain unknown, assume only that internal files were claimed as taken and act accordingly.

Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach datasets. This provides a practical first step while official confirmation of the full scope of the stb.ro incident remains limited.

AICompiled with AI assistance from public sources and published under our editorial standards.