Delap & Waller targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: January 13, 2025

Lynx group claims data breach at Delap & Waller

The threat actor known as Lynx has announced the publication of data belonging to Delap & Waller on its leak site. According to the group's announcement, the organization has been targeted in a cyberattack that resulted in the exfiltration of a significant amount of information. The group claims to have obtained more than 300 GB of data from the organization's network. This announcement was made on January 13, 2025, though the group alleges that the breach itself occurred earlier, specifically on December 4, 2024.

Ransomware attacks of this nature often follow a pattern where threat actors gain unauthorized access to a network to steal sensitive information before encrypting systems. Once the data is stolen, the attackers typically use a leak site to pressure the victim into paying a ransom. This specific incident involves the claim of a large-scale data theft that could have wide-reaching implications for the affected entity.

Details of the claimed exfiltration

The information provided by the Lynx group suggests that the breach is extensive in terms of the volume of data stolen. The group claims that the stolen data includes a variety of sensitive categories that could impact various stakeholders within the organization. The reported leak is said to include the following types of information:

• User data
• Business data
• Employee data
• Financial data
• Backup files

The inclusion of backup files in the claimed exfiltration is particularly significant. In many modern ransomware campaigns, attackers prioritize the theft of backups to ensure that the victim cannot easily restore their systems without paying the ransom, thereby increasing the attacker's leverage.

About Delap & Waller

Delap & Waller is a UK-based firm providing professional consultancy, project management, and quantity surveying services. The organization primarily serves the construction and property management sectors, providing specialized expertise to its clients in these industries.

Impact and assessment of the incident

This breach may pose secondary risks such as identity theft and targeted phishing attacks for the organization's employees and clients. As the organization is based in the UK, the incident may be subject to investigation by data protection authorities under the UK GDPR. The exposure of financial and operational data could lead to reputational damage and legal sanctions.

The group, which utilizes double extortion tactics, may continue to exert pressure through the threat of further data publication. Double extortion is a strategy where attackers not only encrypt the victim's data but also threaten to release sensitive information publicly if the ransom is not met. This method is designed to maximize the pressure on the organization by threatening its reputation and legal standing.

Furthermore, the reported code similarity between Lynx and INC Ransom suggests that the group may employ professional and destructive tactics. When ransomware groups exhibit similarities in their codebases, it often indicates a level of sophistication and a systematic approach to their operations. Organizations in the professional services sector, which often handle sensitive client information and financial records, must remain vigilant against such threats. Defensive measures typically include robust network segmentation, regular security awareness training, and maintaining offline, immutable backups to mitigate the impact of such attacks.