Engine Power Source listed by Lynx ransomware group

• Ransomware group: Lynx
• Country: United States
• Sector: Manufacturing
• Announcement date: January 30, 2025

Lynx claims data exfiltration at Engine Power Source

The ransomware group known as Lynx has officially listed the manufacturing firm Engine Power Source on its dedicated leak site. According to the threat actor, the group has successfully exfiltrated a massive volume of data from the organization's systems. The announcement, made on January 30, 2025, coincides with the date the group claims the attack occurred. This latest incident highlights the ongoing trend of double extortion, a tactic where cybercriminals not only encrypt an organization's data but also steal sensitive information to use as leverage for ransom demands.

In this specific case, the Lynx group has issued a significant ransom demand of $20,000,000. The threat actors have stated that the management of Engine Power Source has remained indifferent to their demands. Consequently, the group has issued a 72-hour ultimatum. The attackers have claimed that if the financial demands are not met within this specified timeframe, the full dataset will be published on their leak site, potentially exposing the company to severe consequences.

Details of the alleged data breach

The scope of the alleged theft is substantial, with the Lynx group claiming to be in possession of 1TB of critical information. While the specific file count was not provided in the announcement, the volume of data suggests a significant breach of the company's digital infrastructure. The threat actors assert that the stolen information is highly sensitive and includes various types of data that could impact multiple stakeholders.

The listing identifies the following categories of affected data:

• Employee personal data
• Partner information

The presence of such data in a leak site listing often serves as a tool for psychological pressure during negotiations. By targeting personal records and partner details, attackers aim to maximize the pressure on an organization to comply with their demands to avoid public exposure and subsequent fallout.

About Engine Power Source

Engine Power Source is a US-based company that provides spare parts and service for industrial engines, generators, and power systems. It specializes in technical support and equipment supply for the heavy industry and energy sectors. Given its role in providing critical components and services for energy and heavy industry, the organization plays a vital part in the industrial supply chain.

Analysis and potential implications

This incident may pose secondary risks such as identity theft and targeted phishing attacks for employees and business partners. Because the stolen data reportedly includes personal and partner information, these individuals may face increased vulnerability to social engineering tactics. Furthermore, the technical similarities noted between the Lynx group and INC Ransom may suggest a sophisticated attack methodology, indicating that the threat actor possesses advanced capabilities.

Given the company's location in the United States, a potential data breach could trigger legal obligations under various state laws and federal regulations. Organizations operating in the manufacturing and energy sectors must be aware that the public release of data can lead to significant reputational damage and operational disruption. Failure to address the ransom demand could lead to the public release of data, which often results in long-term consequences for the victimized entity.

To defend against such sophisticated threats, organizations in the manufacturing sector can implement several defensive steps. These include maintaining robust, offline backups to ensure operational continuity and implementing strict access controls to limit the movement of attackers within a network. Additionally, continuous monitoring of network traffic and employee training on identifying phishing attempts are essential components of a modern cybersecurity posture. As ransomware groups continue to evolve, the ability to detect and respond to unauthorized data exfiltration remains a critical priority for industrial organizations.