ITU AbsorbTech listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Manufacturing
• Announcement date: February 26, 2025

Lynx ransomware group claims data breach at ITU AbsorbTech

The threat actor known as Lynx has listed the United States-based organization ITU AbsorbTech on its leak site. According to the group's announcement, they have successfully exfiltrated a significant amount of data from the company. The group claims to have stolen approximately 240 GB of information, marking a significant potential security incident for the industrial service provider.

The claim was officially announced on the group's leak site on February 26, 2025. While the announcement was made recently, the group alleges that the actual attack took place much earlier, specifically on December 17, 2024. This discrepancy between the attack date and the public listing is a common occurrence in ransomware operations, where actors may hold data for several months before moving to the extortion phase.

Details of the alleged data exfiltration

The Lynx ransomware group has provided specific details regarding the nature of the compromised information. According to the group's claims, the stolen data is not limited to a single category but spans several critical business functions. The group alleges that the exfiltrated content includes sensitive administrative and operational files that could impact the organization's internal security and external business relationships.

Based on the information provided by the threat actor, the following types of data are reportedly included in the breach:

• Customer data
• Contracts
• Financial data
• HR data
• Active Directory dumps

Furthermore, the group has indicated that the stolen content may include incident records and stock-related data. The inclusion of Active Directory dumps is particularly noteworthy in a cybersecurity context, as these files often contain highly sensitive information regarding network architecture, user accounts, and permission structures, which can be used to facilitate further lateral movement within a network.

About ITU AbsorbTech

ITU AbsorbTech is a family-owned company that has been operating since 1930. The organization provides sustainable solutions tailored for industrial facilities. Their product range is diverse, including items such as reusable absorbents, towels, mops, and floor mats. The company maintains a significant operational footprint across the eastern United States, managing 13 different locations to serve its industrial clientele.

Analysis and potential implications of the attack

This alleged data breach presents several significant risks to the organization. From a security standpoint, the presence of Active Directory dumps and HR documents suggests that the attackers may have gained deep access to the internal environment. This type of exposure can lead to secondary risks, such as identity theft for the organization's employees and highly targeted phishing attacks directed at both staff and customers.

Because ITU AbsorbTech is a United States-based entity, the incident may trigger complex legal processes. Depending on the specific nature and sensitivity of the compromised data, the organization may be subject to various state laws and federal regulations regarding data protection and breach notification. Additionally, the sensitivity of the published data could negatively impact the company's commercial reputation and its ability to maintain operational continuity.

The Lynx group appears to be employing double-extortion tactics. This method involves not only encrypting a victim's systems but also stealing sensitive data to use as leverage. By threatening to leak the information on a public site, the group aims to pressure the organization into paying a ransom to prevent the disclosure of its private records. It is also worth noting that the Lynx group, which emerged in 2024, has been observed to share code similarities with the INC Ransom group, which may suggest a level of technical sophistication in their attack methods.

In general, organizations facing such threats often focus on defensive strategies such as implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to mitigate the risk of initial access and subsequent data exfiltration.