Encore Leisure Group listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United Kingdom
• Sector: Hospitality
• Announcement date: September 11, 2025

Lynx ransomware group claims data breach at Encore Leisure Group

The threat actor known as Lynx has officially listed the United Kingdom-based organization Encore Leisure Group on its dedicated leak site. This announcement, which appeared on September 11, 2025, follows a claimed attack date of September 8, 2025. The group has published a claim regarding a data breach, asserting that they have obtained sensitive information belonging to the hospitality provider.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data. If the ransom is not paid, the group threatens to release the stolen information publicly to cause reputational, legal, and operational damage. This method increases the leverage the attackers hold over the target organization.

Details of the claimed incident

According to the announcement made by the Lynx group, the listing includes a screenshot provided as proof of the breach. This screenshot reportedly contains information regarding the operational activities of Encore Leisure Group. Furthermore, the shared image displays data presented in a tabular format, which the group claims contains critical financial information.

The specific types of data mentioned in the leak claim include:

• Financial data
• Payment records

While the group has provided these visual proofs, they have not disclosed the total size of the data stolen or the specific number of files involved. Additionally, no ransom demand has been publicly stated by the group in relation to this specific claim.

About Encore Leisure Group

Encore Leisure Group is a provider of hospitality and leisure services based in the United Kingdom. The company specializes in the management and operation of various leisure facilities and holiday parks, serving as a key player in the UK hospitality sector.

Potential impact and risk assessment

The claim made by the Lynx group introduces significant risks to the organization's financial operations and sensitive commercial data. Because the organization is based in the United Kingdom, any confirmed data breach could fall under the regulatory scope of the UK General Data Protection Regulation (UK GDPR), which could potentially lead to legal sanctions for the company.

Technical analysis suggests that the Lynx group may possess sophisticated attack methods, as there is noted code similarity between Lynx and the INC Ransom group. This level of sophistication increases the threat profile for the target. Beyond the organization itself, there are secondary risks for customers and business partners, who may face threats such as targeted phishing attacks or identity theft resulting from the exposure of payment and financial details.

For organizations operating in the hospitality and leisure sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive measures include maintaining offline backups, implementing multi-factor authentication, and conducting regular security awareness training to prevent initial access. Furthermore, maintaining strict data minimization practices can help reduce the volume of sensitive information available to attackers in the event of a successful intrusion. The potential consequences of such ransomware incidents include significant reputational damage and operational disruptions that can affect the continuity of business services.