Lincoln Office listed on Hunters ransomware leak site

• Ransomware group: Hunters
• Country: United States
• Sector: Professional Services
• Announcement date: November 24, 2023

Hunters ransomware group targets Lincoln Office

The Hunters International ransomware group has officially listed Lincoln Office on its dedicated leak site. This announcement, made on November 24, 2023, serves as a public claim by the threat actor that the organization has been compromised. According to the group's claims, the attack involved both the exfiltration of sensitive information and the encryption of the organization's internal systems.

Ransomware attacks of this nature often follow a double extortion model. In such scenarios, threat actors do not merely lock an organization out of its own systems; they also steal sensitive data before the encryption process begins. This allows the attackers to threaten the public release of the stolen information if a ransom is not paid, creating a secondary layer of pressure on the victim organization.

Details of the alleged breach

The announcement by the Hunters International group provides specific metrics regarding the scale of the alleged intrusion. The group claims that the breach resulted in the compromise of a significant volume of data. While the specific nature or categories of the files have not been detailed by the attackers, the sheer volume of the claimed theft is substantial.

The group's claims regarding the compromised data include the following:

• Total data volume: 370.4 GB
• Total file count: 298,618 files

It is important to note that the attackers have not provided any specific details regarding the actual content or the nature of the exfiltrated data beyond these quantitative measurements. No information has been provided regarding a ransom demand, as that field remains unknown in the current report.

About Lincoln Office

Lincoln Office is a professional services company based in Illinois, United States. The organization specializes in the office furniture and workspace design sector. Their service offerings include providing furniture solutions, interior space planning, and comprehensive office design services tailored for various businesses.

Analysis and potential implications

Technical assessments suggest that Hunters International is utilizing the Hive ransomware codebase to conduct its operations. The exfiltration of data in an incident like this can lead to various secondary risks, such as the potential exposure of sensitive information belonging to employees or clients. Because Lincoln Office operates within the professional services sector, there is a heightened possibility that the leaked data could contain sensitive client information or trade secrets.

Furthermore, since the organization is based in the United States, such a breach may trigger specific legal obligations. Depending on the nature of the data and the specific state laws applicable to an Illinois-based entity, the organization may face various data protection laws and mandatory notification requirements to regulators and affected individuals.

While reports suggest that the group may have ceased its encryption activities in 2025, this incident highlights a persistent threat. Legacy listings on leak sites can continue to pose risks long after the initial attack, as the stolen data remains available for exploitation or further exposure. Organizations in the professional services sector can mitigate these risks by implementing robust data loss prevention measures, maintaining strict access controls, and ensuring comprehensive backup strategies are in place to defend against encryption-based attacks.