Amourgis & Associates listed by Lynx ransomware group

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: January 3, 2025

The Lynx ransomware group has listed the law firm Amourgis & Associates on its dedicated leak site. According to the group's announcement, the threat actor claims to have exfiltrated 100 GB of data from the organization's systems.

The claimed attack event

The threat actor known as Lynx officially listed Amourgis & Associates on its leak site on January 3, 2025. Through this announcement, the group claims to have successfully accessed the firm's network on December 25, 2024. The group has stated that 100 GB of data has been exfiltrated and has threatened that the information may be published on their platform.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. In many modern cyberattacks, threat actors utilize a tactic known as double extortion. In a double extortion scenario, the attackers do not just encrypt a victim's files to disrupt operations; they also steal sensitive information before the encryption occurs. This allows them to threaten the public release of the stolen data if the ransom is not met, significantly increasing the pressure on the target organization.

Data involved in the claim

The information provided by the threat actor includes a sample that reportedly contains a bankruptcy notice filed in the Northern District of Ohio, United States. This sample is said to contain sensitive information regarding debtors. The listing suggests that the following types of data may be at risk:

• Bankruptcy filings
• Debtor information

While the specific file count and the exact ransom demand remain unknown, the group's claim regarding the volume of data suggests a significant breach of information.

Organization profile

Amourgis & Associates is a law firm specializing in personal injury and bankruptcy law. The firm serves individual consumers and focuses on the legal needs of individuals rather than representing businesses or insurance companies.

Implications and industry considerations

The claim made by Lynx suggests that sensitive personal and financial data belonging to the law firm's clients may be at risk of exposure. Because the organization is a US-based entity, a potential data breach of this nature could trigger legal proceedings under federal regulations and state-level privacy laws. Furthermore, the clients of the firm may face increased risks of identity theft or become targets of highly specific, targeted phishing attacks.

The group's technical profile shows a reported code similarity between Lynx and INC Ransom. This similarity suggests that the group may employ professional and destructive attack methodologies during their operations. It is assessed that the firm may be subject to double extortion tactics as part of the group's strategy.

For organizations operating within the professional services sector, especially those handling sensitive legal and financial documentation, maintaining robust cybersecurity defenses is critical. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular network monitoring to detect unauthorized access. Furthermore, strict access controls and encryption of sensitive data at rest and in transit can help mitigate the impact of an exfiltration event. As attackers continue to use professional methodologies, organizations must remain vigilant against sophisticated intrusion techniques.