lynx
First seen July 29, 2024Active418 claimed victims
The claims below are reproduced as posted by lynx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| shgcpa.com | April 7, 2025 | ransomware_live | — |
| Restaurant Associates | April 4, 2025 | ransomware_live | — |
| Maruichi Leavitt Pipe & Tube | April 4, 2025 | ransomware_live | — |
| buildingmaterialspecialties.com | March 31, 2025 | ransomware_live | — |
| Alton Steel | March 30, 2025 | ransomware_live | — |
| dhsmithco.com | March 27, 2025 | ransomware_live | — |
| corporateflight.com | March 27, 2025 | ransomware_live | — |
| Amatech | March 26, 2025 | ransomware_live | — |
| friscochamber.com | March 26, 2025 | ransomware_live | — |
| pay4freight.com | March 26, 2025 | ransomware_live | — |
| Direct Traffic Control | March 25, 2025 | ransomware_live | — |
| Solar Optimum | March 25, 2025 | ransomware_live | — |
| Palomino Petroleum | March 19, 2025 | ransomware_live | — |
| nevadareadymix.com | March 17, 2025 | ransomware_live | — |
| toolsign.com | March 15, 2025 | ransomware_live | — |
| Tryon | March 14, 2025 | ransomware_live | — |
| Fulcrum Lifting | March 14, 2025 | ransomware_live | — |
| Doumen | March 14, 2025 | ransomware_live | — |
| amatechinc.com | March 14, 2025 | ransomware_live | — |
| gramoll.com | March 14, 2025 | ransomware_live | — |
| spscompanies.com | March 12, 2025 | ransomware_live | — |
| Springfield Water and Sewer Commission | March 11, 2025 | ransomware_live | — |
| AMICIO | March 7, 2025 | ransomware_live | — |
| Schmiedetechnik Plettenberg GmbH & Co KG | March 5, 2025 | ransomware_live | — |
| Pervedant | March 5, 2025 | ransomware_live | — |
| AJF Inspections & Engineering | March 5, 2025 | ransomware_live | — |
| Martin Mechanical (martin.local) | March 5, 2025 | ransomware_live | — |
| Seabank Group | March 4, 2025 | ransomware_live | — |
| La Unión | March 3, 2025 | ransomware_live | — |
| fstlogistics.com | March 3, 2025 | ransomware_live | — |
| Commercial Concrete Systems | February 28, 2025 | ransomware_live | — |
| CabinC.com | February 28, 2025 | ransomware_live | — |
| Engineering Mechanics | February 27, 2025 | ransomware_live | — |
| Hire Velocity (lan.hirevelocity.com) | February 27, 2025 | ransomware_live | — |
| ACTi Corporation | February 25, 2025 | ransomware_live | — |
| Indiv Usa | February 25, 2025 | ransomware_live | — |
| PPS Services Group | February 24, 2025 | ransomware_live | — |
| Penn Emblem (penn.local) | February 24, 2025 | ransomware_live | — |
| Planet One | February 21, 2025 | ransomware_live | — |
| Harrells.com | February 21, 2025 | ransomware_live | — |
| Adval Tech | February 20, 2025 | ransomware_live | — |
| derichsukonertz.de | February 19, 2025 | ransomware_live | — |
| Allied Tenesis | February 17, 2025 | ransomware_live | — |
| Autoschade Pippel | February 17, 2025 | ransomware_live | — |
| HRS_IDEA_Expertises | February 17, 2025 | ransomware_live | — |
| Leadership Strategies | February 17, 2025 | ransomware_live | — |
| Vvf Ilinois Services | February 17, 2025 | ransomware_live | — |
| acmefan.com | February 16, 2025 | ransomware_live | — |
| Solar Optimum | February 15, 2025 | ransomware_live | — |
| (kc2) geokon.com | February 15, 2025 | ransomware_live | — |
| Geokon | February 15, 2025 | ransomware_live | — |
| solaroptimum.com | February 15, 2025 | ransomware_live | — |
| ACDC Express | February 14, 2025 | ransomware_live | — |
| Xepa Soul | February 11, 2025 | ransomware_live | — |
| GANRO | February 10, 2025 | ransomware_live | — |
| Fortune Electric Co Ltd | February 10, 2025 | ransomware_live | — |
| Marshall Motor Holdings | February 9, 2025 | ransomware_live | — |
| pacresmortgage.com | February 9, 2025 | ransomware_live | — |
| Pacific Residential Mortgage | February 9, 2025 | ransomware_live | — |
| Stürmer Maschinen | February 8, 2025 | ransomware_live | — |
| Dynamic Closures | February 8, 2025 | ransomware_live | — |
| Banfi Vintners | February 5, 2025 | ransomware_live | — |
| Shinsung Delta Tech | February 5, 2025 | ransomware_live | — |
| Tugwell Pump & Supply | February 4, 2025 | ransomware_live | — |
| (M)Empire-home-center | January 31, 2025 | ransomware_live | — |
| lofotenseafood.com | January 31, 2025 | ransomware_live | — |
| Longue Vue Club | January 31, 2025 | ransomware_live | — |
| Tri-Sen Systems | January 30, 2025 | ransomware_live | — |
| Scott Engineering | January 30, 2025 | ransomware_live | — |
| KPI Engineering | January 30, 2025 | ransomware_live | — |
| Engine Power Source | January 30, 2025 | ransomware_live | — |
| Zamzow's | January 30, 2025 | ransomware_live | — |
| Delta Screen & Filtration | January 29, 2025 | ransomware_live | — |
| Rossi Real Estate (ROSSIDG.LOCAL) | January 29, 2025 | ransomware_live | — |
| Lexington Electric | January 29, 2025 | ransomware_live | — |
| Biogena GmbH & Co KG | January 29, 2025 | ransomware_live | — |
| sce.org.sg | January 28, 2025 | ransomware_live | — |
| Empire Home Center | January 23, 2025 | ransomware_live | — |
| Winbas | January 23, 2025 | ransomware_live | — |
| Mintz Law Firm, LLC | January 22, 2025 | ransomware_live | — |
| The Brown & Hurley Group | January 22, 2025 | ransomware_live | — |
| hamton | January 22, 2025 | ransomware_live | — |
| Marukai | January 21, 2025 | ransomware_live | — |
| Kassin & Carrow | January 18, 2025 | ransomware_live | — |
| Alo Center (hq.aloteknik.se) | January 18, 2025 | ransomware_live | — |
| Pedensia Graphics Distribution | January 17, 2025 | ransomware_live | — |
| Tech NH | January 17, 2025 | ransomware_live | — |
| Access Capital Partners SA | January 16, 2025 | ransomware_live | — |
| planetone-asia.com | January 16, 2025 | ransomware_live | — |
| IDEA Expertises | January 16, 2025 | ransomware_live | — |
| Lowe Engineers | January 15, 2025 | ransomware_live | — |
| Douglas County, GA (DDCWSA.COM) | January 14, 2025 | ransomware_live | — |
| Kinseth Hospitality Companies | January 14, 2025 | ransomware_live | — |
| QualiTech (qualitech.com) | January 14, 2025 | ransomware_live | — |
| Browdy (bl.local) | January 13, 2025 | ransomware_live | — |
| communisis.com & paragon.world | January 9, 2025 | ransomware_live | — |
| D-7 Roofing | January 7, 2025 | ransomware_live | — |
| Ranhill Bersekutu | January 6, 2025 | ransomware_live | — |
| Hunter Taubman Fischer & Li | January 5, 2025 | ransomware_live | — |
| ciscientific.com.au | January 4, 2025 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).