Port of Rijeka Listed by 8base Ransomware Group

On November 30, 2024, the Port of Rijeka (Luka Rijeka d.d.) appeared on the leak site operated by the 8base ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the Croatian port operator, which holds the largest concession for dry-cargo shipping and reloading in the Rijeka basin and provides maritime traffic services, cargo storage, equipment maintenance, and related economic activities.

Reported Details from the Listing

The 8base leak-site entry, accessible via the onion address hosted on ransomware.live, claims that data was stolen from the port’s systems but does not specify the volume of records, the exact file types, or the number of individuals whose information may be contained in the archive. It simply lists the victim under the heading “Port of Rijeka – Luka Rijeka d.d.” and indicates that the files are now available for download by authorized parties on the extortion platform. No ransom amount or payment deadline is displayed in the public portion of the listing. The disclosure therefore leaves several key specifics unknown, including whether employee, customer, contractor, or partner personal data was included in the exfiltrated material.

Why This Matters for You and Your Family

Even when a breach targets a large infrastructure operator rather than a consumer service, the consequences reach ordinary people. Port employees, vendors, shipping customers, and anyone whose personal or financial details passed through Luka Rijeka’s systems could find their information exposed. Internal files frequently contain spreadsheets with names, addresses, national identification numbers, contract details, and banking information. Once such data leaves the victim’s control, it circulates among criminal networks and can be used for identity theft, tax fraud, or targeted phishing years after the initial incident. If you or a family member has worked at the port, shipped goods through it, or had business dealings with Luka Rijeka since the concession agreement was active, your information may now be in circulation.

Doxxing and Identity-Chain Risks

Ransomware leaks rarely stop at one dataset. Criminals combine newly released internal files with information from earlier breaches to build detailed profiles. An email address taken from the port’s vendor list can be matched to gaming accounts, social-media handles, or family addresses already floating on other forums. This linking process turns a single breach into a persistent doxxing chain that can expose children’s usernames, household locations, and financial relationships. Credential leaks of this nature often cascade into account takeovers on personal email, banking, or gaming platforms, amplifying the original exposure far beyond the port’s own systems.

8base’s Known Track Record

Public reporting attributes the emergence of 8base to mid-2022. The group has since listed hundreds of organizations, focusing primarily on small-to-medium businesses and mid-sized infrastructure operators rather than only the largest global targets. Typical playbook involves initial access through compromised remote desktop credentials or vulnerable VPNs, followed by exfiltration of sensitive files before encryption. 8base then demands payment in exchange for not publishing the stolen data, frequently using double-extortion tactics that combine encryption with public shaming on their leak site. The group’s listings often appear on dedicated onion domains and are mirrored on clear-web aggregator sites such as ransomware.live, allowing researchers and other criminals to monitor fresh victims in near real time.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the included cleanup of Warden to remove what can be taken down immediately.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you learn within hours rather than months.
• Rotate any password you have reused at the Port of Rijeka or related business systems, replace it with a unique passphrase, and secure all accounts with 2FA through an authenticator app rather than SMS.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts, which often become the next link in the same identity chain when a parent’s work data is leaked.
• Let the remediation specialists handle repeated takedown requests across data brokers and extortion sites so you do not have to chase every new appearance yourself.

The incident underscores that infrastructure breaches now routinely place ordinary families in the crosshairs of organized ransomware operations. Staying ahead requires more than reactive password changes; it demands ongoing visibility into how your identity is being reassembled across the criminal underground. DoxxScan by GalaxyWarden delivers that visibility through continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today and close the gaps before the next wave of leaked data reaches the marketplaces.