Lynx ransomware group lists csb-battery.com on its leak site

• Ransomware group: Lynx
• Country: Taiwan
• Sector: Manufacturing
• Announcement date: May 10, 2026

Lynx ransomware group claims data breach at CSB Energy Technology

The threat actor known as Lynx has officially listed CSB Energy Technology Co., Ltd. on its leak site, announcing a significant data breach. According to the group's announcement made on May 10, 2026, the attackers claim to have successfully gained unauthorized access to the organization's internal systems and exfiltrated various types of sensitive information. This incident follows the common pattern of double extortion, where ransomware groups not only encrypt an organization's data to disrupt operations but also steal sensitive files to use as leverage during ransom negotiations.

The group has issued a ransom demand of 15,400,000 USD in exchange for not releasing the stolen information. Such high-value demands are characteristic of sophisticated ransomware operations that target high-revenue organizations. In these scenarios, the threat actor typically threatens to publish the stolen data on a public leak site if the ransom is not paid, creating immense pressure on the victimized company regarding both operational continuity and reputational damage.

Details of the claimed exfiltration

The announcement by Lynx provides specific details regarding the nature of the data they claim to have stolen from the organization. The group asserts that they have obtained a variety of critical business and technical files. According to the claims, the exfiltrated data includes:

• Contracts
• Financial data
• Confidential information
• Customer data
• Active Directory (AD) dumps

In addition to these specific data types, the group claims to possess evidence of encrypted files, which suggests that the attack involved both data theft and the deployment of encryption mechanisms within the network. The presence of Active Directory dumps is particularly concerning, as these files often contain sensitive information about the network's structure, user accounts, and permissions, which can be used by attackers to facilitate lateral movement or further compromise the environment.

About CSB Energy Technology Co., Ltd.

CSB Energy Technology Co., Ltd. is a global manufacturer specializing in VRLA lead-acid batteries. Their products serve a wide range of critical sectors, including telecommunications, data centers, and renewable energy industries. The company maintains a significant international presence, operating through an extensive distribution network that serves customers in over 100 countries.

Risk assessment and potential impact

This incident poses significant risks to the organization's operational continuity and data privacy. The alleged theft of financial and customer data could create secondary risks for the organization's supply chain partners and customers, potentially leading to a ripple effect of security concerns throughout the manufacturing sector. Furthermore, because the organization is based in Taiwan, the breach may trigger legal processes under relevant local data protection regulations and international standards.

The technical sophistication of the attacker cannot be overlooked; the code similarity between the Lynx group and INC Ransom suggests that the group may employ highly advanced methods during their campaigns. The public release of such sensitive data can provide a foundation for identity theft and highly targeted phishing attacks against the company, its employees, or its clients. For organizations in the manufacturing sector, such incidents highlight the importance of robust defensive measures, including regular offline backups, strict network segmentation, and comprehensive monitoring of Active Directory to detect unauthorized access or unusual data movement.