Ransomware: Deadlock claims Eko-Flor Plus d.o.o. (HR) — Agriculture and Food Production

A new ransomware incident has been publicly reported involving Eko-Flor Plus d.o.o., a Croatian company in the agriculture and food production sector. The breach was published on the ransomware.live data leak site on 10 July 2026, under the BREACH framework. This confirms that the threat actor known as Deadlock has exfiltrated data from the victim and is likely demanding a ransom to prevent its release. The publication of this incident serves as a formal notification that sensitive operational or personal data may have been compromised.

This event directly affects Eko-Flor Plus d.o.o. and its stakeholders, but it also signals a broader risk to organizations in the agriculture and food production sector across the EU. These entities are increasingly targeted due to their critical role in supply chains and often limited cybersecurity maturity. Compliance teams in similar organizations should treat this as a sector-wide alert, as attackers may replicate tactics against other firms in the region.

Compliance teams should immediately verify whether their organization has any data-sharing or supply chain links with Eko-Flor Plus. They must also review their own ransomware response plans, ensuring that incident detection, data backup integrity, and notification procedures under GDPR or NIS2 are current. If your organization operates in agriculture or food production, conduct a targeted risk assessment for ransomware and confirm that breach reporting timelines to supervisory authorities are clearly documented and tested.