Linney targeted by Dunghill ransomware group in massive data leak claim

• Ransomware group: Dunghill
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: April 27, 2025

Dunghill group claims massive data leak against Linney

The threat actor known as Dunghill has listed data allegedly belonging to Linney on its leak site. According to the announcement made on April 27, 2025, the group claims to have obtained a significant volume of information, totaling 5TB, following an attack that reportedly occurred on March 20, 2025. The group asserts that the stolen information was exfiltrated directly from the organization's file servers.

Ransomware leak sites are frequently used by cybercriminals to host stolen data as a method of public pressure. This tactic is often associated with double-extortion strategies, where attackers not only encrypt an organization's systems but also threaten to release sensitive information to the public to compel payment. By publishing data on a dedicated site, threat actors aim to maximize the reputational damage to the victim, thereby increasing the likelihood of a ransom being paid.

Details of the claimed data exfiltration

The announcement made by Dunghill includes various corporate and client data that the group asserts was taken during the breach. Based on the information provided by the threat actor, the leaked data is highly sensitive and covers multiple aspects of the organization's operations and client relationships. The scope of the alleged theft includes the following items:

• Client design data
• Corporate data
• Financial documents
• Marketing strategies
• Account statements
• KPI reports
• Non-disclosure agreements
• Databases
• Encryption keys
• Certificates
• HR data
• IT infrastructure information

The presence of such diverse data types suggests a deep penetration into the target's internal systems. The inclusion of technical assets like encryption keys, certificates, and IT infrastructure documentation is particularly concerning, as these can be utilized by attackers to facilitate further unauthorized access or secondary attacks against the organization's network environment.

About Linney

Linney is a sixth-generation British multichannel marketing services group that provides graphic design, brand strategy, digital marketing, and video production. The company delivers campaign management and content solutions for major global brands such as McDonald's and Starbucks.

Impact and industry implications

This incident may have negative impacts on Linney's commercial reputation due to the exposure of sensitive client and operational data. The exposure of client data could lead to a loss of trust among business partners and may result in risks related to the breach of contractual obligations. Furthermore, as the organization is based in the UK, the incident may be subject to review by data protection authorities under the UK GDPR, potentially triggering legal processes.

For organizations operating within the professional services sector, particularly those handling high-profile global clients, such incidents highlight the critical importance of robust data protection frameworks. The inclusion of encryption keys and IT infrastructure information in the leaked data could increase the risk of secondary attacks against the organization's systems. To mitigate such risks, organizations often implement multi-layered security strategies, including strict access controls, regular security audits, and comprehensive encryption protocols for data at rest and in transit.

Defensive measures typically involve proactive monitoring of network traffic to detect unauthorized exfiltration and the implementation of zero-trust architectures to limit the lateral movement of attackers. Additionally, maintaining rigorous compliance with regional data protection regulations is essential for managing legal and reputational risks following a potential breach. In this case, the methods used by the Dunghill group indicate an intent to pressure organizations through double-extortion strategies, a trend that continues to challenge the security posture of global marketing and service providers.