lynx
First seen July 29, 2024Active418 claimed victims
The claims below are reproduced as posted by lynx on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| Gossett Motor Cars | December 31, 2024 | ransomware_live | — |
| Silverado Contractors | December 28, 2024 | ransomware_live | — |
| Hisingstads Bleck | December 28, 2024 | ransomware_live | — |
| Amourgis & Associates | December 25, 2024 | ransomware_live | — |
| powelltool.com | December 24, 2024 | ransomware_live | — |
| SERGAS Group | December 23, 2024 | ransomware_live | — |
| Farrar & Ball | December 21, 2024 | ransomware_live | — |
| u0 Excel Transportation | December 21, 2024 | ransomware_live | — |
| Jacobs & Thompson | December 20, 2024 | ransomware_live | — |
| LINTEC & LINNHOFF Holdings | December 20, 2024 | ransomware_live | — |
| Angotti & Reilly | December 17, 2024 | ransomware_live | — |
| ITU AbsorbTech | December 17, 2024 | ransomware_live | — |
| Clutch Industries | December 15, 2024 | ransomware_live | — |
| Wireless Solutions (Morris.Domain) | December 15, 2024 | ransomware_live | — |
| Goins Law | December 12, 2024 | ransomware_live | — |
| Smith Tank & Steel (smith-tank.com) | December 12, 2024 | ransomware_live | — |
| Banner Day Camp | December 12, 2024 | ransomware_live | — |
| CM Buck & Associates | December 11, 2024 | ransomware_live | — |
| astaphans.com | December 10, 2024 | ransomware_live | — |
| Astaphans | December 10, 2024 | ransomware_live | — |
| Nash Brothers Construction (nashdom.local) | December 10, 2024 | ransomware_live | — |
| Hosting.co.uk | December 9, 2024 | ransomware_live | — |
| jimthompson.com | December 8, 2024 | ransomware_live | — |
| Jim Thompson | December 8, 2024 | ransomware_live | — |
| Sentinel Systems | December 6, 2024 | ransomware_live | — |
| Gills Onions | December 5, 2024 | ransomware_live | — |
| Societatea Energetica Electrica S.A. | December 5, 2024 | ransomware_live | — |
| GBC | December 4, 2024 | ransomware_live | — |
| Delap & Waller | December 4, 2024 | ransomware_live | — |
| Mmaynewagemicro | December 2, 2024 | ransomware_live | — |
| New Age Micro | December 2, 2024 | ransomware_live | — |
| The Wendt Agency | November 30, 2024 | ransomware_live | — |
| WPD.WOODPORTDOORS.COM | November 27, 2024 | ransomware_live | — |
| Woodport Doors | November 27, 2024 | ransomware_live | — |
| GMG | November 25, 2024 | ransomware_live | — |
| Talascend | November 25, 2024 | ransomware_live | — |
| Jalaram Produce | November 25, 2024 | ransomware_live | — |
| PHG CPAs (bushman.biz) | November 24, 2024 | ransomware_live | — |
| Extra | November 23, 2024 | ransomware_live | — |
| Wisconsin Lifting Specialists | November 22, 2024 | ransomware_live | — |
| Equity & Advisory | November 19, 2024 | ransomware_live | — |
| Conad (conad.lan) | November 18, 2024 | ransomware_live | — |
| Keable & Brown | November 16, 2024 | ransomware_live | — |
| Grupo_Trisan | November 15, 2024 | ransomware_live | — |
| Grupo Trisan | November 15, 2024 | ransomware_live | — |
| TOC | November 15, 2024 | ransomware_live | — |
| Everything Breaks | November 15, 2024 | ransomware_live | — |
| Hydra-Matic Packing | November 15, 2024 | ransomware_live | — |
| Suneva Medical(sunevamedical.com) | November 14, 2024 | ransomware_live | — |
| Suneva Medical | November 14, 2024 | ransomware_live | — |
| SCM GROUP | November 11, 2024 | ransomware_live | — |
| Siltech (siltechcorp.local) | November 9, 2024 | ransomware_live | — |
| Banco de Fomento Internacional | November 6, 2024 | ransomware_live | — |
| Novati Constructions | November 6, 2024 | ransomware_live | — |
| Strategic Materials | November 2, 2024 | ransomware_live | — |
| Textiles Coated International | October 31, 2024 | ransomware_live | — |
| Inland Tarp & Liner | October 31, 2024 | ransomware_live | — |
| Hypertype | October 29, 2024 | ransomware_live | — |
| TaxPros of Clermont | October 24, 2024 | ransomware_live | — |
| BeClever | October 24, 2024 | ransomware_live | — |
| LmayInteroute agency | October 21, 2024 | ransomware_live | — |
| Interoute agency | October 21, 2024 | ransomware_live | — |
| NEBRASKALAND | October 19, 2024 | ransomware_live | — |
| WimCoCorp | October 17, 2024 | ransomware_live | — |
| Denkali | October 16, 2024 | ransomware_live | — |
| Precision Electrical Systems | October 16, 2024 | ransomware_live | — |
| ValueMax Group | October 16, 2024 | ransomware_live | — |
| Mark Thomas | October 15, 2024 | ransomware_live | — |
| plowmancraven.co.uk | October 11, 2024 | ransomware_live | — |
| Plowman Craven | October 11, 2024 | ransomware_live | — |
| tankstar.com | October 9, 2024 | ransomware_live | — |
| Tankstar | October 9, 2024 | ransomware_live | — |
| Sit & Sleep | October 7, 2024 | ransomware_live | — |
| dzsi.com | October 5, 2024 | ransomware_live | — |
| DSZ | October 5, 2024 | ransomware_live | — |
| Model Die & Mold | October 4, 2024 | ransomware_live | — |
| FUN-LAB | October 2, 2024 | ransomware_live | — |
| Funlab | October 2, 2024 | ransomware_live | — |
| Tricon Energy | September 29, 2024 | ransomware_live | — |
| triverus.com | September 25, 2024 | ransomware_live | — |
| Triverus | September 25, 2024 | ransomware_live | — |
| NSK Group ROTA | September 20, 2024 | ransomware_live | — |
| LifeMine | September 16, 2024 | ransomware_live | — |
| lifeminetx.com | September 16, 2024 | ransomware_live | — |
| English Construction Company | September 12, 2024 | ransomware_live | — |
| Blain Supply | September 9, 2024 | ransomware_live | — |
| futuremetals.com | September 4, 2024 | ransomware_live | — |
| Future Metals | September 4, 2024 | ransomware_live | — |
| idom.com | September 3, 2024 | ransomware_live | — |
| Myelec Electrical | August 23, 2024 | ransomware_live | — |
| kidkraft.com | August 21, 2024 | ransomware_live | — |
| KidKraft | August 21, 2024 | ransomware_live | — |
| tcn.local | August 21, 2024 | ransomware_live | — |
| Rushlift (lks.net) | August 20, 2024 | ransomware_live | — |
| Cruz Marine (cruz.local) | August 20, 2024 | ransomware_live | — |
| Bay Sales (cog.local) | August 18, 2024 | ransomware_live | — |
| MacEwen Petroleum | August 16, 2024 | ransomware_live | — |
| Tranter (tcn.local) | August 16, 2024 | ransomware_live | — |
| Wallace Construction Specialties (wcs.local)) | August 14, 2024 | ransomware_live | — |
| Gortemoller Engineering (gorteng.local) | August 13, 2024 | ransomware_live | — |
Claim data from ransomware.live and RansomLook (CC BY 4.0).