Lynx ransomware group claims data breach at Richard Mille Asia Pte. Ltd. and D'League Pte. Ltd.

• Ransomware group: Lynx
• Country: Singapore
• Sector: Professional Services
• Announcement date: July 19, 2025

Lynx ransomware group claims data breach at Richard Mille Asia Pte. Ltd. and D'League Pte. Ltd.

The threat actor known as Lynx has listed Richard Mille Asia Pte. Ltd. and D'League Pte. Ltd. on its dedicated leak site. According to the announcement, the group claims to have successfully compromised data belonging to these specific entities. The notification regarding this alleged incident was published on July 19, 2025, while the group cites the actual attack date as June 27, 2025.

Details of the alleged incident

The claims made by the Lynx group suggest a targeted operation against a specific corporate structure. The threat actor alleges that it has obtained data from various companies that fall within Dave Tan's holding structure. This implies that the breach may not be limited to a single isolated entity but could potentially involve multiple interconnected organizations within the same management umbrella.

Ransomware groups often utilize leak sites to pressure victims by threatening to release sensitive information. This tactic, frequently referred to as double extortion, involves both encrypting a victim's systems and stealing data to use as leverage during negotiations. While the presence of a listing on a leak site is a significant indicator of a targeted attack, it is important to note that these claims are made by the threat actor and have not been independently verified.

Information regarding the stolen data

At this stage, there is no detailed information regarding the nature of the alleged stolen data. The listing does not specify the volume of files or the specific types of information that may have been exfiltrated. Furthermore, the provided screenshot associated with the claim shows a 404 error message, indicating that the specific page on the leak site is currently inaccessible. The listing names no specific data types.

Organization profiles

The entities mentioned in the claim include Richard Mille Asia Pte. Ltd. and D'League Pte. Ltd. Richard Mille is a Swiss luxury watch manufacturer known for using high-tech materials and innovative designs. Richard Mille Asia serves as the regional hub managing the brand's operations and distribution in the Southeast Asian market.

Potential risks and industry implications

The claims made by the Lynx group may pose significant risks of data privacy breaches and reputational damage to the affected entities. For these Singapore-based companies, it is possible that regulatory investigations under the PDPA (Personal Data Protection Act) could be initiated following such an incident. If the data is eventually published, it could lead to secondary risks, such as the exposure of employee or customer information.

Technical analysis suggests a level of sophistication in these operations. There is reported code similarity between Lynx and INC Ransom, which suggests that the technical sophistication of the attacks may be significant. Such similarities often indicate that the actors are utilizing advanced development techniques or shared toolsets to execute their campaigns.

In the professional services and luxury goods sectors, maintaining data integrity and confidentiality is paramount. Organizations in these sectors can take several defensive steps to mitigate the impact of such threats, including:

• Implementing robust multi-factor authentication across all corporate systems.
• Maintaining regular, offline, and tested backups to ensure business continuity.
• Conducting frequent security awareness training for employees to prevent initial access via phishing.
• Employing advanced endpoint detection and response mechanisms to identify unauthorized lateral movement.

Public information regarding the Lynx group remains limited, making it difficult to determine the full scope of their operations or their long-term objectives.