Lynx ransomware group claims to have stolen data from Grupo Trisan

• Ransomware group: Lynx
• Country: Costa Rica
• Sector: Agriculture and Food Production
• Announcement date: November 17, 2024

Lynx ransomware group targets Grupo Trisan

The threat actor known as Lynx has published a claim on its leak site involving the Costa Rican organization Grupo Trisan. According to the announcement, the group has exfiltrated a significant amount of data from the company's network. This incident follows the pattern of double extortion, a common ransomware tactic where attackers not only encrypt an organization's systems but also steal sensitive information to use as leverage during negotiations.

The group claims to have successfully exfiltrated over 400 GB of data from the organization's network. While the announcement was made public on November 17, 2024, the threat actor alleges that the data was actually obtained on November 15, 2024. No specific information regarding a ransom demand has been provided in the leak site announcement.

Details of the alleged data exfiltration

The announcement made by Lynx provides specific details regarding the types of information that have been allegedly compromised. The group claims that the stolen dataset includes a variety of sensitive information categories. To support their claims, the group has provided visual evidence in the form of screenshots that display file directory structures from the target's environment.

The data types listed in the claim include:

• User data
• Business data
• Employee data
• Production data
• Financial records

The exposure of such diverse data types—ranging from internal business operations to individual employee details—highlights the broad scope of the alleged breach. In many ransomware campaigns, the goal is to maximize pressure on an organization by threatening to release information that impacts multiple stakeholders, including customers and staff.

About Grupo Trisan

Grupo Trisan is an established organization based in Costa Rica. Since 1961, the company has been providing innovative solutions for the agricultural, livestock, food, and water sectors throughout Central America and the Caribbean. Given its long-standing presence in these essential industries, the organization plays a significant role in the regional supply chain for food and water resources.

Potential impact and industry implications

The alleged leak of this data may pose significant secondary risks to the organization. For employees and customers, the exposure of personal information can lead to risks such as identity theft or the targeting of individuals through sophisticated phishing attacks. Furthermore, the potential exposure of financial and production data could harm the organization's competitive standing and lead to operational disruptions.

Because Grupo Trisan is based in Costa Rica, the incident may also lead to legal sanctions regarding compliance with local data protection regulations. The impact of such a breach often extends beyond immediate technical recovery, potentially causing long-term damage to the organization's reputation regarding its data security capabilities.

While information regarding the Lynx group remains limited, the group has shown reported code similarities with INC Ransom, which suggests they may be operating a professional ransomware campaign. In the agriculture and food production sector, maintaining data integrity and confidentiality is vital for operational continuity and market trust. Organizations in this sector typically focus on robust defensive measures, such as network segmentation, regular offline backups, and strict access controls, to mitigate the risks posed by professional ransomware groups.