Excel Security listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: February 22, 2025

Lynx claims to have compromised Excel Security

The threat actor known as Lynx has officially listed Excel Security on its ransomware leak site. According to the announcement made by the group, the organization's data has been compromised. This listing follows a common pattern in modern cyberattacks known as double extortion, where threat actors not only encrypt an organization's systems but also threaten to leak sensitive information on public platforms to increase pressure during ransom negotiations.

The announcement regarding the potential breach was posted on the group's leak site on February 22, 2025. While the listing serves as a public claim by the threat actor, the specific details regarding the extent of the intrusion remain limited to the information provided by the group itself.

Details of the claimed attack

The Lynx ransomware group claims that the compromise of Excel Security occurred much earlier than the public announcement. Specifically, the group alleges that the organization was targeted and successfully breached on May 30, 2024. This significant gap between the claimed date of the attack and the date of the leak site announcement highlights a common tactic used by ransomware groups, where they may hold data for an extended period before moving to the public exposure phase.

Regarding the specific information that has been allegedly stolen, the listing does not provide a detailed inventory of the files or the volume of data involved. The record and any associated screenshots do not specify the nature of the leaked data, nor do they provide a file count or a specific data size. Consequently, the listing names no specific data types or categories of information.

About Excel Security

Excel Security is a professional services firm that provides a wide range of comprehensive security solutions. The company serves a diverse clientele, including governments, corporations, and individuals on a global scale. Their service portfolio is extensive, encompassing consulting, executive protection, the installation of electronic systems, and biometric identification technologies.

With a workforce exceeding 750 employees, the organization provides both physical and technological security services. The firm maintains a particularly strong presence in the Tri-State region, offering specialized expertise in safeguarding its clients through various security methodologies.

Risk assessment and industry implications

The claim made by the Lynx group carries significant implications given the nature of Excel Security's operations. Because the company operates within the security and consulting sector, there is a potential risk that sensitive client information and operational data could be exposed. For a US-based entity like Excel Security, such a breach could trigger complex legal proceedings under various state-level privacy laws and specific sectoral regulations designed to protect sensitive data.

The technical profile of the Lynx group suggests a sophisticated threat. There is reported code similarity between the Lynx group and the INC Ransom group, which indicates that their technical capabilities and attack methods should be treated with a high degree of caution. Such similarities often suggest a level of development and methodology that can pose a serious threat to organizations in the professional services sector.

Beyond the immediate impact of the claim, secondary risks include the potential for the leaked data to be utilized in identity theft or targeted phishing campaigns. When sensitive organizational or client data is compromised, attackers often use it to craft highly convincing social engineering attacks. Organizations in this sector can mitigate these risks by implementing robust defensive measures, such as multi-factor authentication, continuous monitoring of network traffic, and strict adherence to data encryption standards. While public information regarding the Lynx group remains limited, the potential for targeted attacks on security-focused firms remains a critical concern for the industry.