Hamton listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Sweden
• Sector: Retail & E-Commerce
• Announcement date: February 17, 2025

Lynx ransomware group claims attack on Hamton

The Lynx ransomware group has officially listed the Swedish retail company Hamton on its dedicated leak site. According to the announcement posted by the threat actor, the organization was targeted in a cyberattack. The group has indicated that the institution's data is at risk of being published as a result of their activities.

The threat actor known as Lynx added Hamton to its leak site on February 17, 2025. The group claims to have conducted its activities against the institution on January 22, 2025. Through an announcement created by the group, it has been stated that the institution's data would be published.

Details regarding the claimed data breach

Regarding the specifics of the incident, the leak announcement does not provide details concerning the volume of information or the specific nature of the files involved. The listing names no specific data types or file content.

In such scenarios, ransomware groups often utilize a method known as double extortion. This tactic involves not only encrypting an organization's internal systems to disrupt operations but also exfiltrating sensitive information to use as leverage. By threatening to leak stolen data on public forums or leak sites, attackers aim to pressure the victim into paying a ransom to prevent the exposure of their information.

Potential risks and implications

The leakage of an institution's data can lead to the exposure of customer and commercial information. Such an event may trigger legal sanctions under the General Data Protection Regulation (GDPR). Furthermore, the publication of such data may create secondary risks for employees and customers, including the possibility of identity theft or the execution of targeted phishing attacks.

About Hamton

Hamton is a retail company based in Gothenburg, Sweden. The organization specializes in providing corporate gifts and promotional products to its clients.

Analysis and industry context

The Lynx group is considered to be a Ransomware-as-a-Service (RaaS) structure that emerged in 2024. Technical analysis suggests that the group shows code similarities with INC Ransom. The use of the RaaS model allows developers to lease their ransomware code to affiliates, who then carry out the actual attacks, making the ecosystem more scalable and harder to dismantle.

For organizations operating within the retail and e-commerce sectors, such attacks present significant operational and reputational challenges. The potential for negative impacts on an institution's operational processes is high when a group like Lynx is involved. To mitigate these risks, organizations typically focus on robust defensive measures, such as maintaining offline backups, implementing multi-factor authentication, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.