Diyar.com listed on lynx ransomware leak site

• Ransomware group: lynx
• Country: Saudi Arabia
• Sector: Retail & E-Commerce
• Announcement date: May 16, 2025

Lynx ransomware group claims breach of diyar.com

The ransomware group known as lynx has listed the domain diyar.com on its dedicated leak site, alleging that the organization has been the target of a cyberattack. This announcement, made on May 16, 2025, constitutes a claim of a data breach by the threat actor. While the group asserts that it has successfully gained access to the organization's data, the incident remains a claim made by the group on their platform.

Details of the alleged attack

According to the announcement posted by the lynx group, the operation against diyar.com was conducted on May 16, 2025. The group's listing serves as a public notification of their alleged successful intrusion into the target's network. The announcement specifies that the group has gained access to the organization's data, though the specific nature of the intrusion remains unverified by external parties.

Ransomware leak sites are platforms used by cybercriminal groups to pressure victims into paying ransoms. These sites often list the names of targeted organizations to increase visibility and pressure. In many modern ransomware campaigns, groups employ a tactic known as double extortion. In a double extortion scenario, attackers do not just encrypt a company's files to disrupt operations; they also exfiltrate sensitive data. If the victim refuses to pay the ransom to unlock their systems, the attackers threaten to release the stolen information on these public leak sites to cause reputational or regulatory damage.

Information regarding compromised data

Regarding the content of the alleged breach, the group has not provided specific information or sample data concerning the nature of the leaked or compromised information. The listing does not include details on the volume of data or the specific file types involved. The provided screenshot associated with the announcement displays only the general interface of the group's leak site and does not offer any details on specific data content.

• No specific data types were named in the listing.

About diyar.com

Diyar is an architecture, engineering, and design firm based in Saudi Arabia. The company provides professional services for various construction and design projects within the architecture, engineering, and design sectors.

Analysis and potential implications

This incident may indicate a potential compromise of corporate or customer data held by diyar.com. The reported code similarity between the lynx group and INC Ransom suggests that the attack methods could be sophisticated. Given the organization's location in Saudi Arabia, a data breach notification obligation under local data protection regulations may arise. Secondary risks may include the use of leaked data for identity theft or targeted phishing campaigns.

When organizations face such threats, several defensive and reactive steps are typically considered. From a technical standpoint, maintaining robust endpoint detection and response (EDR) systems and ensuring regular, offline backups are critical for resilience. From a regulatory perspective, organizations must stay vigilant regarding local data protection laws to ensure compliance in the event of a confirmed breach. Furthermore, because sophisticated groups may use stolen information for targeted phishing, organizations should focus on continuous employee security awareness training to mitigate the risk of social engineering attacks following a leak.