lynx
First seen July 29, 2024Active418 claimed victims
The claims below are reproduced as posted by lynx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| www.medwayplastics.com | September 4, 2025 | ransomware_live | — |
| denraytire.com | September 4, 2025 | ransomware_live | — |
| www.metrotech.edu | September 4, 2025 | ransomware_live | — |
| city-of-batavia | September 4, 2025 | ransomware_live | — |
| volanno.com | September 4, 2025 | ransomware_live | — |
| bemac-merivale | September 4, 2025 | ransomware_live | — |
| www.primax.com | September 4, 2025 | ransomware_live | — |
| www.onahotels.com | September 4, 2025 | ransomware_live | — |
| pesadoconstruction | September 4, 2025 | ransomware_live | — |
| highdoc.de | September 4, 2025 | ransomware_live | — |
| firstlight.net | September 4, 2025 | ransomware_live | — |
| www.ziegler-design.de | September 4, 2025 | ransomware_live | — |
| elektro-buder.at | September 4, 2025 | ransomware_live | — |
| www.sixgunsllc.com | September 4, 2025 | ransomware_live | — |
| www.independentpaperboard.com | September 4, 2025 | ransomware_live | — |
| www.dimarcogroup.com | September 2, 2025 | ransomware_live | — |
| oakland-museum-of-california | August 29, 2025 | ransomware_live | — |
| BÜCHNER BARELLA Holding | August 27, 2025 | ransomware_live | — |
| Hanson Chambers | August 26, 2025 | ransomware_live | — |
| Sterlings Accountancy Solutions | August 26, 2025 | ransomware_live | — |
| True World Group LLC | August 19, 2025 | ransomware_live | — |
| Ben-Mor Inc. | August 19, 2025 | ransomware_live | — |
| cibraco | August 5, 2025 | ransomware_live | — |
| Frontline Bioenergy | August 4, 2025 | ransomware_live | — |
| Lincoln Law | August 1, 2025 | ransomware_live | — |
| www.pefco.com | July 29, 2025 | ransomware_live | — |
| premiersurfacesinc | July 28, 2025 | ransomware_live | — |
| Tooling Systems Group | July 28, 2025 | ransomware_live | — |
| Drive & Shine | July 24, 2025 | ransomware_live | — |
| https://eagleonline.net/ | July 23, 2025 | ransomware_live | — |
| Morrow Equipment | July 23, 2025 | ransomware_live | — |
| Admiral Gaming Network | July 21, 2025 | ransomware_live | — |
| Adrian Kenya | July 15, 2025 | ransomware_live | — |
| Inside One | July 15, 2025 | ransomware_live | — |
| Nippn TH | July 15, 2025 | ransomware_live | — |
| ci-Fabrics | July 15, 2025 | ransomware_live | — |
| gid-it.de | July 15, 2025 | ransomware_live | — |
| salamanderresort.com | July 10, 2025 | ransomware_live | — |
| Nactarome | July 9, 2025 | ransomware_live | — |
| Victoria Garden | July 9, 2025 | ransomware_live | — |
| Greta Group | July 8, 2025 | ransomware_live | — |
| ITACCESS PTE. LTD. | July 7, 2025 | ransomware_live | — |
| Confartigianato Imprese | July 3, 2025 | ransomware_live | — |
| nactarome.eu | June 30, 2025 | ransomware_live | — |
| www.simmonsboardman.com | June 30, 2025 | ransomware_live | — |
| Woodtect | June 27, 2025 | ransomware_live | — |
| RICHARD MILLE ASIA PTE. LTD & D'LEAGUE PTE. LTD. | June 27, 2025 | ransomware_live | — |
| Inflite Engineering Services | June 24, 2025 | ransomware_live | — |
| lurie-glass | June 24, 2025 | ransomware_live | — |
| motorsport-de-la-capitale | June 24, 2025 | ransomware_live | — |
| iBUYPOWER | June 20, 2025 | ransomware_live | — |
| siamgas and petrochemicals public company ltd | June 18, 2025 | ransomware_live | — |
| hubermanlaw.co.il | June 17, 2025 | ransomware_live | — |
| The Providence Warwick Convention | June 15, 2025 | ransomware_live | — |
| Levinzon CPA | June 12, 2025 | ransomware_live | — |
| gouverneur.com | June 11, 2025 | ransomware_live | — |
| accountant falavinha.local | June 10, 2025 | ransomware_live | — |
| HK Hardware & Engineering | June 10, 2025 | ransomware_live | — |
| Best Profil | June 6, 2025 | ransomware_live | — |
| lgipr | June 6, 2025 | ransomware_live | — |
| quenotedeporten | June 6, 2025 | ransomware_live | — |
| Davies, Mcfarland & Carroll | June 4, 2025 | ransomware_live | — |
| GRECA Asfaltos (grupogreca.com.br) | June 4, 2025 | ransomware_live | — |
| yahtec | June 3, 2025 | ransomware_live | — |
| Frazier & Bowles | June 3, 2025 | ransomware_live | — |
| frazierbowles.com | June 3, 2025 | ransomware_live | — |
| Biogest | June 2, 2025 | ransomware_live | — |
| Chrisman Commercial | May 31, 2025 | ransomware_live | — |
| Rousseau | May 30, 2025 | ransomware_live | — |
| university of chile | May 30, 2025 | ransomware_live | — |
| abfe | May 23, 2025 | ransomware_live | — |
| Bizcom Electronics | May 23, 2025 | ransomware_live | — |
| Wilkie Sanderson | May 21, 2025 | ransomware_live | — |
| diyar.com | May 16, 2025 | ransomware_live | — |
| Diyar | May 16, 2025 | ransomware_live | — |
| Gearhiser Peters Elliott & Cannon | May 15, 2025 | ransomware_live | — |
| Telcom Insurance Group | May 15, 2025 | ransomware_live | — |
| kosmas.cz | May 4, 2025 | ransomware_live | — |
| runtec.co.jp | May 2, 2025 | ransomware_live | — |
| Runtec | May 2, 2025 | ransomware_live | — |
| WDEF-TV | May 1, 2025 | ransomware_live | — |
| David Mills CPA, LLC | April 28, 2025 | ransomware_live | — |
| impactcanada.com | April 25, 2025 | ransomware_live | — |
| Vicarage Court Solicitors | April 24, 2025 | ransomware_live | — |
| end2endtechnologies | April 24, 2025 | ransomware_live | — |
| greatplainstransport.com | April 24, 2025 | ransomware_live | — |
| Farmo Res | April 23, 2025 | ransomware_live | — |
| R&N Manufacturing | April 22, 2025 | ransomware_live | — |
| Hyalogic | April 16, 2025 | ransomware_live | — |
| Feldman & Lopez | April 16, 2025 | ransomware_live | — |
| Springer & Steinberg | April 16, 2025 | ransomware_live | — |
| Lake HVAC | April 15, 2025 | ransomware_live | — |
| Astra Products | April 15, 2025 | ransomware_live | — |
| McElwee Firm | April 15, 2025 | ransomware_live | — |
| southernagllc.com | April 15, 2025 | ransomware_live | — |
| bilbie.com.au | April 12, 2025 | ransomware_live | — |
| Colmar Industrial Supplies | April 11, 2025 | ransomware_live | — |
| Royal Chemical | April 11, 2025 | ransomware_live | — |
| amethystgroup.co.uk | April 10, 2025 | ransomware_live | — |
| Sally B Gold | April 8, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).