Dynamic Closures targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: Canada
• Sector: Manufacturing
• Announcement date: March 6, 2025

Lynx group targets Dynamic Closures in massive extortion attempt

The threat actor known as Lynx has officially listed the Canadian manufacturing firm Dynamic Closures on its dedicated leak site. According to the announcement made on March 6, 2025, the group claims to have successfully breached the organization's systems. The ransomware group is demanding a ransom payment of 19 million dollars to prevent further action or the release of stolen information.

This incident follows a claimed attack date of February 8, 2025. In modern cyber extortion, groups often employ a "double extortion" tactic. This method involves not only encrypting an organization's critical systems to disrupt operations but also exfiltrating sensitive data. By threatening to leak this stolen information on a public leak site, the attackers create additional pressure on the victim to meet the ransom demands, leveraging the threat of reputational damage and regulatory scrutiny.

Details of the claimed breach and data exfiltration

The listing provided by Lynx suggests a significant compromise of the target's digital infrastructure. The group claims that the organization's systems have been encrypted, which typically results in a total loss of access to essential business functions and operational data. Furthermore, the threat actor claims that a data breach has occurred, involving the theft of various corporate documents.

While the specific volume of data and the exact number of files stolen have not been disclosed by the group, the announcement identifies several categories of sensitive information that have allegedly been exfiltrated. The leaked data is said to include:

• Contracts
• HR records
• Financial data

The presence of such diverse data types indicates that the attackers may have gained broad access to different segments of the corporate network, ranging from administrative and human resources departments to financial management systems.

About Dynamic Closures

Dynamic Closures is a manufacturing company based in Canada. The firm specializes in the design and production of security shutters and grille systems tailored for commercial and retail spaces. Known for its innovative security solutions, the company focuses on a customer-oriented service approach to provide essential security infrastructure for various business environments.

Impact assessment and industry implications

The actions taken by the Lynx group could have profound consequences for Dynamic Closures. Beyond the immediate operational disruption caused by system encryption, the exposure of sensitive information poses long-term risks. The inclusion of HR records and financial data in the leak increases the potential for identity theft and makes employees and business partners targets for highly specific, sophisticated phishing attacks.

Because the organization is headquartered in Canada, the incident may trigger regulatory considerations under the Personal Information Protection and Electronic Documents Act (PIPEDA). Organizations operating in the manufacturing sector must be aware that such breaches can damage commercial reputations and disrupt supply chain security. The sophistication of the attack is noted by the group's potential code similarity to INC Ransom, suggesting that the methods used may be highly advanced.

To defend against such threats, organizations in the manufacturing sector typically implement multi-layered security strategies. These include maintaining offline, immutable backups to ensure operational continuity, enforcing strict multi-factor authentication (MFA) across all access points, and conducting regular network segmentation to prevent lateral movement by attackers. Additionally, continuous monitoring of network traffic and employee training regarding phishing awareness are essential components of a robust defensive posture against sophisticated ransomware groups.