Hisingstads Bleck listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Sweden
• Sector: Manufacturing
• Announcement date: February 17, 2025

The Lynx ransomware group has announced the listing of the Swedish manufacturing firm Hisingstads Bleck on its leak site. This announcement, which appeared on the group's platform, suggests that the organization has been targeted in a cyberattack.

The claimed attack details

The threat actor known as Lynx has published an announcement claiming to target Hisingstads Bleck. According to the information provided, the claimed attack date for this incident is December 28, 2024. The announcement was officially posted on the group's leak site on February 17, 2025.

Investigations into the leak site indicate that the page for the institution is currently inaccessible, returning a 404 error. This suggests that the listing may have been removed or is temporarily unavailable. When threat actors use leak sites, they typically aim to pressure victims by showcasing the stolen data, though the availability of such pages can fluctuate due to law enforcement actions, technical issues, or the group's own management of their platform.

Data involved in the incident

There is no information available regarding the nature of the data allegedly leaked. The provided screenshot shows that the relevant leak page returns a 404 error. Consequently, the listing names no data types.

Organization profile

Hisingstads Bleck- och Plåtslageri AB is a Swedish company that has been operating in the sheet metal construction and roofing business for over 100 years. The company specializes in metalworking and sheet metal applications.

Analysis and implications

The Lynx group is reported to have emerged in 2024 and shares code similarities with INC Ransom. Given the group's known activities, it is possible that a double extortion method has been employed; however, the nature of the data remains uncertain at this time. Double extortion is a common ransomware tactic where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure to pay the ransom.

If the institution's data has been compromised, it may trigger data breach notification obligations under the GDPR applicable in Sweden. The publication of such data could pose secondary risks, such as identity theft or targeted phishing attacks, for the institution's employees and business partners. In the manufacturing sector, such breaches can impact supply chain integrity and sensitive business communications.

Organizations facing such threats often focus on defensive measures such as implementing robust backup solutions, enforcing multi-factor authentication, and maintaining rigorous patch management to close vulnerabilities. Furthermore, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection regulations are critical components of a modern cybersecurity posture.