lynx
First seen July 29, 2024Active418 claimed victims
The claims below are reproduced as posted by lynx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| cutlercapital | August 29, 2026 | ransomlook | — |
| www.talbotdes.org | August 6, 2026 | ransomware_live | — |
| www.jerryleigh.com | August 6, 2026 | ransomware_live | — |
| www.wolfconstruction.net | June 18, 2026 | ransomware_live | — |
| www.eastersealsia.org | June 18, 2026 | ransomware_live | — |
| www.someco.com | June 18, 2026 | ransomware_live | — |
| www.commonwealth-partners.com | June 11, 2026 | ransomware_live | — |
| www.kurita.eu | May 10, 2026 | ransomware_live | — |
| funkychunky.com | May 10, 2026 | ransomware_live | — |
| csb-battery.com | May 10, 2026 | ransomware_live | — |
| ossistemes.com | May 10, 2026 | ransomware_live | — |
| jacksoncountyin.com | May 10, 2026 | ransomware_live | — |
| bayareaherbs.com | May 10, 2026 | ransomware_live | — |
| st-annes.uk.com | May 10, 2026 | ransomware_live | — |
| lifelongaccess.org | May 10, 2026 | ransomware_live | — |
| sentrydynamics.com | April 13, 2026 | ransomware_live | — |
| ACNHealthcare | April 8, 2026 | ransomware_live | — |
| www.smithdollar.com | April 7, 2026 | ransomware_live | — |
| Stonehenge | April 6, 2026 | ransomware_live | — |
| cwwcontractors.com | March 29, 2026 | ransomware_live | — |
| njpcs.org | March 17, 2026 | ransomware_live | — |
| indrub.com | March 12, 2026 | ransomware_live | — |
| Africa Insurance | March 6, 2026 | ransomware_live | — |
| https://www.hegelmann.com | March 1, 2026 | ransomware_live | — |
| Keller Polska | February 28, 2026 | ransomware_live | — |
| structuredassetservices.com | February 17, 2026 | ransomware_live | — |
| powersmiller.com | February 17, 2026 | ransomware_live | — |
| gbaco.com | February 17, 2026 | ransomware_live | — |
| Stera Chemicals | February 17, 2026 | ransomware_live | — |
| secure.ae | February 12, 2026 | ransomware_live | — |
| Keylogistics Chile | February 11, 2026 | ransomware_live | — |
| Altalingua | February 10, 2026 | ransomware_live | — |
| www.trisa.ch | February 4, 2026 | ransomware_live | — |
| peterboroughpublichealth.ca | February 3, 2026 | ransomware_live | — |
| www.roschvisionary.com | January 30, 2026 | ransomware_live | — |
| shorelinenyc.com | January 30, 2026 | ransomware_live | — |
| La Rioja Alta | January 30, 2026 | ransomware_live | — |
| Ocean Fish | January 14, 2026 | ransomware_live | — |
| www.swautomation.at | January 6, 2026 | ransomware_live | — |
| madisonareaymca.org | January 5, 2026 | ransomware_live | — |
| swdc.wa | January 5, 2026 | ransomware_live | — |
| salcom.com | January 5, 2026 | ransomware_live | — |
| groupecho.com | January 5, 2026 | ransomware_live | — |
| hartford.fr | January 5, 2026 | ransomware_live | — |
| kiddsservices.com | January 5, 2026 | ransomware_live | — |
| wildbunchdistribution.com | January 5, 2026 | ransomware_live | — |
| www.braemac.com | January 5, 2026 | ransomware_live | — |
| miltonfl.org | January 5, 2026 | ransomware_live | — |
| laurysenkitchens.com | January 5, 2026 | ransomware_live | — |
| www.stcharlesprep.org | January 5, 2026 | ransomware_live | — |
| crawfordorthodontics.net | January 5, 2026 | ransomware_live | — |
| www.blackdogsalvage.com | January 5, 2026 | ransomware_live | — |
| www.mcphillamysgold.com | January 5, 2026 | ransomware_live | — |
| www.mscorp.net | January 5, 2026 | ransomware_live | — |
| www.ville-dunkerque.fr | January 5, 2026 | ransomware_live | — |
| www.granosycereales.com.co | January 5, 2026 | ransomware_live | — |
| www.sje.vic.edu.au | January 5, 2026 | ransomware_live | — |
| www.tecnoelectric.com.py | January 5, 2026 | ransomware_live | — |
| www.burdettedental.com | January 5, 2026 | ransomware_live | — |
| Grupo Ruiz | January 4, 2026 | ransomware_live | — |
| Options | December 31, 2025 | ransomware_live | — |
| CSA Tax & Advisory | December 26, 2025 | ransomware_live | — |
| www.fecrwy.com | December 23, 2025 | ransomware_live | — |
| ccedarvalleyservices.org | December 23, 2025 | ransomware_live | — |
| https://www.omnibusjp.com | December 23, 2025 | ransomware_live | — |
| ruskcountywi.us | December 23, 2025 | ransomware_live | — |
| https://www.ckm-montagen.de/en/ | December 23, 2025 | ransomware_live | — |
| terport.com.py | December 21, 2025 | ransomware_live | — |
| L.O. Trading | December 18, 2025 | ransomware_live | — |
| www.advancedentdenver.com | December 16, 2025 | ransomware_live | — |
| www.ktlgroup.com | December 16, 2025 | ransomware_live | — |
| www.eliteflower.com | December 8, 2025 | ransomware_live | — |
| Trucash | December 6, 2025 | ransomware_live | — |
| www.toc.co.jp | December 6, 2025 | ransomware_live | — |
| sspinnovations.com | November 27, 2025 | ransomware_live | — |
| vanteceurope.com | November 22, 2025 | ransomware_live | — |
| classiccenter.com | November 11, 2025 | ransomware_live | — |
| simmerscrane.com | October 24, 2025 | ransomware_live | — |
| Navigator Business Solutions | October 24, 2025 | ransomware_live | — |
| ozsoft.com.au | October 22, 2025 | ransomware_live | — |
| www.ccls.org | October 21, 2025 | ransomware_live | — |
| www.dekalbcountyga.gov | October 21, 2025 | ransomware_live | — |
| trailridgeenergy | October 21, 2025 | ransomware_live | — |
| marquscompanies.com | October 21, 2025 | ransomware_live | — |
| saacke.com | October 20, 2025 | ransomware_live | — |
| nationalcoatingsinc.com | October 13, 2025 | ransomware_live | — |
| www.cbsaust.org.au | October 10, 2025 | ransomware_live | — |
| americanhome | October 7, 2025 | ransomware_live | — |
| suratisweetmart.com | October 2, 2025 | ransomware_live | — |
| TriMed Inc. (Henry Schein) | October 2, 2025 | ransomware_live | — |
| TriMed Inc. HSIC | October 2, 2025 | ransomware_live | — |
| VIR | September 24, 2025 | ransomware_live | — |
| lwginc.net | September 24, 2025 | ransomware_live | — |
| www.margaritavilleatsea.com | September 23, 2025 | ransomware_live | — |
| Dodd-group-ltd | September 23, 2025 | ransomware_live | — |
| CAS EXhibition Partners | September 15, 2025 | ransomware_live | — |
| olarra | September 14, 2025 | ransomware_live | — |
| Bounds Gillespie Killebrew Tushek Architects | September 8, 2025 | ransomware_live | — |
| Encore Leisure Group | September 8, 2025 | ransomware_live | — |
| rose-acre-farms-inc | September 7, 2025 | ransomware_live | — |
Page 1 of 5Older →
Claim data from ransomware.live and RansomLook (CC BY 4.0).