Banco de Fomento Internacional targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: Venezuela
• Sector: Financial Services
• Announcement date: November 12, 2024

Lynx group claims data breach at Banco de Fomento Internacional

The threat actor group known as Lynx has listed the Venezuelan financial institution, Banco de Fomento Internacional, on its dedicated leak site. According to the group's announcement, they claim to have successfully exfiltrated a significant volume of data from the organization's internal systems.

The listing, which appeared on the group's leak site on November 12, 2024, marks a significant escalation in the threat landscape for the targeted institution. The group's claims suggest a targeted operation aimed at acquiring sensitive information held by the financial entity.

Details of the alleged attack and ransom demand

According to the claims made by the Lynx group, the breach occurred around November 6, 2024. The threat actors assert that they have obtained approximately 220 GB of data from the institution. This volume of data suggests a substantial intrusion into the organization's digital infrastructure.

In line with modern double extortion tactics, where attackers not only encrypt systems but also threaten to release stolen information to pressure victims, the group has issued a ransom demand. The group is reportedly demanding a payment of 5,400,000 dollars in exchange for their promise not to publish the stolen data on their public leak site.

Double extortion is a common strategy used by ransomware groups to increase their leverage. By threatening to leak sensitive information, attackers can target an organization's reputation and regulatory standing, making them more likely to pay the ransom to prevent public exposure of their data.

Potential impact on sensitive data

While the full extent of the breach remains to be verified, the group has provided visual evidence, such as screenshots, to support their claims. The file directories and sample documents visible in these screenshots suggest that a variety of highly sensitive information may have been compromised during the attack.

The data types identified in the leaked samples include:

• Financial records
• Client lists
• Audit reports
• Private banking data

The presence of such data types indicates a high level of sensitivity, as these files often contain the core operational and personal information required for banking activities.

Organization profile and risk assessment

Banco de Fomento Internacional is a financial institution based in Venezuela. It operates within the banking and financial services sector, making it a high-value target for cybercriminals due to the sensitive nature of the data it manages.

This alleged data breach may significantly increase the risk of identity theft and fraud for the clients of Banco de Fomento Internacional. Furthermore, because the reported data includes critical financial records, the institution may face intense regulatory scrutiny and potential administrative sanctions from governing bodies.

The sophistication of this attack is highlighted by the reported similarity between the Lynx group and the INC Ransom group, which may suggest that the attack methods used were highly advanced. Such similarities often indicate that secondary extortion attempts—where attackers contact victims through multiple channels—may occur following the initial breach.

For organizations in the financial sector, such incidents underscore the necessity of robust data security protocols. To mitigate potential reputational damage and operational risks, institutions often find it necessary to re-evaluate their security frameworks and proactively notify all affected parties regarding the potential compromise of their information.