Keller Polska listed on lynx ransomware leak site

• Ransomware group: lynx
• Country: Poland
• Sector: Manufacturing
• Announcement date: March 13, 2026

Manufacturing firm Keller Polska targeted by lynx ransomware group

The ransomware group known as lynx has officially listed the Polish company Keller Polska on its dedicated leak site. According to the announcement made by the threat actors, the group claims to have successfully carried out a cyberattack against the organization's systems. This listing follows a period of alleged unauthorized access, marking a potential escalation in the group's activities against the manufacturing sector.

Details of the claimed attack

The listing of Keller Polska was announced on the lynx leak site on March 13, 2026. While the group has publicly claimed to have conducted an action against the company's systems, they have not provided specific details regarding the nature of the intrusion or the exact methods used to penetrate the network. Furthermore, the group has not shared detailed information regarding the content of their post, and the screenshot provided by the attackers remains inaccessible to observers.

Ransomware groups often utilize leak sites as a tool for double extortion, a tactic where attackers not only encrypt a victim's data to disrupt operations but also threaten to publish sensitive information to pressure the organization into paying a ransom. By listing a company on a public site, these groups aim to maximize reputational damage and increase the pressure on the victim's management to meet their demands.

Data involvement and specifics

At this stage, there is no information regarding the nature of the allegedly leaked data. The listing names no specific data types, and the content of the provided screenshot cannot be viewed. Consequently, the volume of files or the specific categories of information involved in this incident remain unknown.

About Keller Polska

Keller Polska is a company operating in the field of geotechnical engineering in Poland and Europe for over 20 years. As part of the Keller Group, it provides expertise and engineering solutions for a wide range of projects, from local initiatives to large-scale infrastructure developments.

Impact assessment and industry implications

This incident may lead to disruptions in the company's operational processes and could create negative impacts on corporate reputation. Because Keller Polska operates within Poland, any potential data breach may result in legal sanctions under the General Data Protection Regulation (GDPR). The implications of such breaches often extend beyond immediate technical recovery, involving complex regulatory compliance and legal obligations.

The methods employed by the lynx group show similarities to those used by the INC Ransom group. This connection suggests that the company may be exposed to secondary risks, such as identity theft or targeted phishing attacks, which often follow the initial breach of a corporate network. Given the group's past activities, there is a risk that the allegedly leaked data could be published in the future.

For organizations in the manufacturing and engineering sectors, such incidents highlight the necessity of robust cybersecurity frameworks. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular employee training to recognize phishing attempts. As threat actors continue to target critical infrastructure and engineering firms, maintaining high levels of visibility across network environments remains a vital component of modern defense strategies.