tankerska.hr Listed by ElDorado Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 11 February 2024 the Croatian shipping firm Tankerska Plovidba, known online as tankerska.hr, appeared on a listing published by the ElDorado ransomware group. The group claims it carried out a ransomware attack and exfiltrated internal files. For anyone whose personal or professional details may sit inside those files—employees, contractors, business partners or customers—the practical stakes are straightforward: the information could be misused for fraud, social engineering or further intrusion if it reaches the open market.

Public detail remains limited. The number of people affected is unknown, and no independent confirmation of the group’s claims has been released. What is known is enough to warrant careful attention from anyone connected to the company.

What happened

According to reports dated 11 February 2024, tankerska.hr was listed by the ElDorado ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. No further technical details—such as the precise date of intrusion, the attack vector, the volume of data taken, or whether systems were encrypted—have been made public. The number of individuals whose information may be involved is likewise undisclosed. The only concrete claim available is the group’s own assertion that internal files left the organisation’s control.

The group behind it: ElDorado

ElDorado is a ransomware operation that follows the now-common double-extortion model: after gaining access to a network, operators encrypt systems and simultaneously copy data, then threaten to publish the material if a ransom is not paid. Victims are typically named on a dedicated leak site, often with sample files offered as proof. The group has been observed targeting organisations across multiple sectors and geographies; its listings are public claims rather than verified forensic findings. In this instance the listing of tankerska.hr should be treated as an unverified assertion by the actors themselves until independent evidence emerges.

tankerska.hr and its sector

Tankerska Plovidba is a Croatian shipping company headquartered in Zadar. It specialises in maritime transport, primarily the tanker and dry-bulk segments, and operates a modern fleet designed for the efficient and safe carriage of oil, oil derivatives and bulk cargo. The company emphasises high operational standards and environmental responsibility. In the maritime sector, firms of this type routinely manage vessel schedules, cargo manifests, crew records, commercial contracts, port documentation and regulatory compliance files. A breach at such an organisation can therefore touch both commercial operations and the personal data of seafarers, shore staff and counterparties.

The information in question

The only data category named in public reporting is “internal files” said to have been exfiltrated. Exact contents remain unconfirmed. Organisations of this kind typically hold employee and crew personal details, payroll and contract information, vessel operational data, commercial correspondence and regulatory filings. Whether any of those categories were among the files claimed by ElDorado has not been independently verified, and no inventory of the material has been released.

Why it matters

If personal data of employees, crew members or business contacts was included, the immediate risks include targeted phishing, identity fraud and unauthorised access to other accounts that reuse the same credentials. For the company itself, exposure of operational or commercial documents can create competitive disadvantage, contractual complications and regulatory scrutiny under data-protection rules. Even when the precise contents stay unknown, the mere claim of exfiltration is enough to place affected individuals on alert and to require the organisation to investigate and notify parties as required by law.

If your data was in this claimed breach

Treat any unexpected contact that references Tankerska Plovidba or shipping-related details with caution. Change passwords on accounts that may have shared credentials, enable multi-factor authentication where available, and monitor bank and credit statements for unusual activity. If you are an employee or contractor, contact the company’s designated security or HR channel for official guidance. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets; such a check is a useful first step but does not replace ongoing vigilance.

AICompiled with AI assistance from public sources and published under our editorial standards.