ACDC Express targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: South Africa
• Sector: Manufacturing
• Announcement date: March 7, 2025

Lynx ransomware group claims attack on ACDC Express

The threat actor known as Lynx has officially listed the South African manufacturing firm ACDC Express on its dedicated leak site. According to the announcement published on March 7, 2025, the group claims to have successfully breached the organization's systems. The threat actor asserts that they have gained unauthorized access to the company's internal environment and have subsequently encrypted its data, effectively disrupting operations.

The timeline provided by the attackers suggests that the initial compromise occurred on February 14, 2025. This indicates that the threat actors may have maintained a presence within the network for a significant period before making their presence known through a public announcement. This delay between the initial attack and the public listing is a common occurrence in modern ransomware campaigns, often allowing attackers to conduct reconnaissance or exfiltrate data before initiating the encryption phase.

Details of the claimed data breach

The announcement made by the Lynx group includes a claim of a data leak and provides a proof of a data dump to support their assertions. However, despite the presence of this proof, the group has not provided any specific details regarding the scope of the leaked information or the specific categories of data that were compromised during the incident.

The listing names no specific data types or categories of information that have been stolen.

Ransom demands and extortion tactics

In conjunction with the claim of data encryption and theft, the Lynx group has issued a significant financial demand. The group is reportedly demanding a ransom of 12,300,000 dollars from ACDC Express to prevent the further dissemination of the stolen information or to provide decryption tools. This high ransom amount suggests that the threat actor is attempting to exert substantial financial pressure on the organization to ensure payment.

While public information regarding the specific operations and identity of the Lynx group remains limited, the nature of this incident suggests the employment of a double extortion strategy. In such scenarios, attackers do not merely encrypt files to disrupt business continuity; they also steal sensitive data to use as leverage. If the victim refuses to pay for the decryption of their systems, the attackers threaten to leak the stolen data publicly, thereby increasing the pressure through the threat of reputational damage and regulatory scrutiny.

About ACDC Express

ACDC Express, also referred to as ACDC Dynamics, is a prominent South African manufacturer, importer, and distributor. The company operates within several critical industrial sectors, including the electrical, electronics, pumps, and tools industries. Established in 1984, the organization has built a significant presence in the market, producing essential industrial components such as transformers, power supplies, and various types of industrial control devices. The company maintains a large workforce, employing over 700 staff members to support its manufacturing and distribution operations.

Potential impacts and organizational implications

This incident poses several significant risks to ACDC Express. From an operational standpoint, the encryption of data can lead to a total halt in manufacturing and distribution processes, severely impacting the organization's ability to meet its commercial obligations. Furthermore, the threat of a data leak presents a major risk to the company's commercial reputation, as clients and partners may lose confidence in the organization's ability to secure its supply chain and proprietary information.

Because the organization is based in South Africa, this incident may trigger legal obligations under the Protection of Personal Information Act (POPIA). Such regulations often require organizations to notify relevant authorities and affected individuals when a breach involving personal data is suspected or confirmed. Additionally, there is an inherent risk that any leaked data could be utilized by other malicious actors for secondary attacks or for identity theft purposes.

For organizations operating in the manufacturing and industrial sectors, such incidents underscore the necessity of robust cybersecurity frameworks. Defensive strategies typically include maintaining regular, offline backups to ensure operational continuity, implementing strict access controls to limit lateral movement within a network, and conducting continuous monitoring to detect unauthorized access early. Given the high stakes of double extortion, organizations must also prepare comprehensive incident response plans that account for both technical recovery and legal/regulatory compliance requirements.