Lynx ransomware group claims data breach at tankstar.com
The threat actor group known as Lynx has claimed to have compromised data belonging to tankstar.com in a recent leak announcement.
- Published
- 2 min read
- 2 min read
- Ransomware group: Lynx
- Country: United States
- Sector: Transportation
- Announcement date: October 9, 2024
Lynx ransomware group claims data breach at tankstar.com
The threat actor group known as Lynx has claimed to have compromised data belonging to tankstar.com in a recent leak announcement. According to the group's post on their leak site, the organization has been targeted in a cyberattack involving data exfiltration.
Details of the claimed attack
On October 9, 2024, the Lynx group listed tankstar.com on their leak site, claiming to have exfiltrated data from the organization. In the announcement, the group indicated a ransom demand of 34 million dollars. To support their claims, the group provided a screenshot containing sample documents that appear to be related to the company's operational processes.
The sample documents shown in the screenshot include a lease agreement with Xerox Financial Services LLC. This specific document contains sensitive information, including the company's full legal name, billing address, contact details, and various contract terms. This type of exposure often occurs during ransomware attacks where actors prioritize high-value administrative and legal documents to increase pressure on the victim.
Affected data types
Based on the information provided by the threat actor, the following types of data are reportedly involved in the incident:
- Lease agreements
- Corporate contact information
- Business data
The presence of these documents suggests that the attackers have gained access to internal administrative files that describe the company's legal and operational framework.
About tankstar.com
Tankstar USA is a US-based logistics and transportation company specializing in the transport of liquid bulk commodities. The company operates a large fleet of tankers for the safe transport of chemical and food-grade products.
Risk assessment and industry implications
This incident may pose a risk of exposing sensitive corporate data held by tankstar.com. The leaked documents could contain details regarding the company's financial relationships with third-party partners and operational specifics, which might be leveraged for supply chain attacks or targeted phishing campaigns. Because the leaked information includes contact details and contract terms, it provides a roadmap for attackers to impersonate company officials or target business partners.
As the organization is based in the US, state-level data breach notification laws and relevant regulatory requirements may apply. Furthermore, given that the Lynx group reportedly shares code similarities with INC Ransom, it is possible that the group employs double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt a victim's systems but also steal sensitive data, threatening to leak it publicly unless a ransom is paid. This increases the risk of secondary incidents as the data is potentially published on the dark web.
For organizations operating in the transportation and logistics sector, such incidents highlight the importance of robust data protection strategies. Common defensive steps for organizations include implementing strict access controls to prevent unauthorized access to sensitive legal and financial documents, maintaining comprehensive logging and monitoring to detect exfiltration early, and conducting regular security awareness training to mitigate the risk of phishing. Additionally, securing the supply chain by verifying the security postures of third-party partners can help reduce the risk of secondary attacks stemming from leaked corporate information.