Idom.com listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: September 4, 2024

Lynx ransomware group claims data breach at idom.com

The threat actor known as Lynx has officially listed the organization idom.com on its ransomware leak site. According to an announcement published on September 4, 2024, the group claims that data belonging to the firm has been compromised. This development follows a purported cyberattack that the group asserts occurred on September 3, 2024. While the group has published a post claiming responsibility, no information has been provided regarding the specific size of the data stolen, the total file count, or the specific ransom demand being sought by the attackers.

Ransomware leak sites serve as a platform for cybercriminals to pressure victims by threatening to release sensitive information. In many modern cyberattacks, threat actors employ a double-extortion model. In this scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. This allows them to demand a second ransom, threatening to leak the stolen information publicly if the victim refuses to pay. This tactic significantly increases the pressure on organizations, as the threat of a public data leak can cause lasting damage to reputation and legal standing.

Details of the claimed incident

The announcement made by the Lynx group on September 4, 2024, indicates that the breach was a recent event, with the claimed attack date being September 3, 2024. To support their claims of a successful intrusion and data theft, the group has shared several documents as proof. These documents were released via screenshots to demonstrate that they have indeed gained access to the target's internal files.

The documents shared in the screenshots provided by the group include specific types of sensitive documentation. The affected data types mentioned in the leak include:

• Non-disclosure agreements
• Business certificates

The presence of such documents suggests that the attackers have targeted administrative and legal files that define the organization's contractual and legal framework.

About idom.com

IDOM is an international firm founded in 1957 that provides engineering, architecture, and consulting services. It carries out projects in various sectors such as infrastructure, industrial facilities, and urban planning. As a large-scale professional services provider, the firm operates across multiple sectors and manages complex projects that require significant coordination and documentation.

Analysis and potential impact

The actions taken by the Lynx group could have significant consequences for the institution. This incident may negatively impact the organization's operational continuity and its commercial reputation. Because the shared documents, such as non-disclosure agreements and business certificates, may contain sensitive information regarding the institution's relationships with partners and clients, the breach could potentially facilitate secondary risks. For example, the exposure of such information can be used to launch highly targeted phishing attacks against the organization or its business associates.

Furthermore, since the institution is based in the United States, the potential leak of sensitive data may trigger legal processes under state-level privacy laws and various sectoral regulations. Organizations operating in the professional services sector must be aware that such incidents often require mandatory reporting to regulatory bodies and affected parties depending on the jurisdiction.

Technical observations suggest that the Lynx group exhibits code similarity with the INC Ransom group. This connection implies that the group's technical capabilities and specific attack methods should be treated with high caution by security professionals. Given their use of the double-extortion model, it is expected that the group may threaten to release further data in the coming period to compel payment. To defend against such threats, organizations typically focus on robust data encryption, strict access controls, and comprehensive monitoring of network traffic to detect unauthorized exfiltration early in the attack lifecycle.