Feldman & Lopez listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: April 16, 2025

Lynx ransomware group claims attack on Feldman & Lopez

The ransomware group known as Lynx has announced the listing of the Florida-based law firm Feldman & Lopez on its leak site. This announcement, made on April 16, 2025, suggests that the professional services firm has been targeted in a cyberattack by the threat actor.

The Lynx group is identified as a Ransomware-as-a-Service (RaaS) entity that emerged in 2024. Technical analysis of the group indicates that they share code similarities with INC Ransom, a factor that may point toward sophisticated attack methodologies. Such RaaS models allow different affiliates to use the group's infrastructure to conduct attacks, often employing complex tactics to compromise high-value targets.

The event was officially announced on the group's leak platform on April 16, 2025. However, observations of the group's infrastructure show that the provided screenshot displays a 404 error page. This technical state suggests that the specific announcement may currently be inaccessible to the public or could be undergoing updates on the leak site.

Details regarding the alleged data breach

At this stage, the specifics of the incident remain limited due to the nature of the available information. No details regarding the nature of the data allegedly leaked or compromised have been provided by the threat actors. Furthermore, the attached screenshot provided by the group shows an error page rather than a list of stolen files.

The listing names no specific data types that have been compromised in this alleged breach.

About Feldman & Lopez

Feldman & Lopez, P.A. is a boutique law firm based in South Florida. Since its establishment in 2015, the firm has specialized in insurance law and civil litigation. The organization provides legal services to residents of Florida, with a specific focus on homeowner insurance claims, post-loss litigation, and disputes involving water or mold remediation.

Risk assessment and implications for the legal sector

The targeting of a law firm presents unique challenges and significant risks. Because law firms handle sensitive client information and legal documentation, a breach of this nature may pose risks of identity theft and fraud for the affected clients. The sensitive nature of legal files makes such organizations prime targets for double extortion tactics.

Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data but also threaten to leak sensitive information on a public leak site to pressure the victim into paying the ransom. This tactic increases the pressure on the victim, as the threat of reputational damage and legal liability becomes a primary motivator for payment.

As the firm operates in the United States, a potential data breach could trigger legal proceedings under state-level data protection laws and professional confidentiality obligations. Organizations in the professional services sector must be prepared for secondary risks, such as spear-phishing campaigns, where attackers use stolen information to craft highly convincing fraudulent messages to target specific individuals.

To mitigate these risks, organizations in this sector often focus on robust defensive measures. These include implementing strict access controls, maintaining comprehensive backups, and conducting regular security awareness training to defend against social engineering. Given the technical similarities between the Lynx group and INC Ransom, organizations should remain vigilant against sophisticated attack methods that may be employed by such groups.