Lynx ransomware group lists jimthompson.com on its leak site

• Ransomware group: Lynx
• Country: Thailand
• Sector: Professional Services
• Announcement date: January 7, 2025

Lynx ransomware group claims data breach at Jim Thompson

The threat actor known as Lynx has published an announcement on its leak site claiming to have exfiltrated a significant amount of data belonging to jimthompson.com. According to the group's posting, the breach occurred around December 8, 2024, and was officially announced on the group's leak site on January 7, 2025. The threat actor is currently demanding a ransom of $5.7 million USD in exchange for not releasing the stolen information.

This type of activity is characteristic of modern ransomware operations, where attackers move beyond simply encrypting local files to actively stealing sensitive information. This method, often referred to as double extortion, involves threatening to leak the stolen data on public forums or specialized leak sites if the ransom is not paid. This increases the pressure on the victim organization by threatening their reputation and legal standing.

Details of the alleged theft and ransom demand

The Lynx group has provided specific details regarding the scale of the alleged intrusion. The group claims that the total volume of exfiltrated data amounts to 203 GB. While the listing includes a screenshot, the content of this image appears to display a directory structure that allegedly belongs to the organization. However, the listing does not provide detailed information regarding the specific types or the exact content of the leaked data.

The listing names no specific data types or individual files that have been compromised. Without further disclosure from the threat actor or a confirmation of the breach, the exact nature of the information contained within the 203 GB remains unknown. The group's claim relies heavily on the provided screenshot of the directory structure to validate their assertion of access.

About Jim Thompson

Jim Thompson is an iconic Thai lifestyle brand that was founded in 1951. The company was established with the specific aim of reviving the Thai silk industry. Today, the organization operates across several diverse fields, including luxury fabrics, fashion products, home furnishings, and restaurant operations.

Potential impacts and security considerations

This alleged leak may create negative impacts on the organization's operational continuity and commercial reputation. Depending on the content of the data, risks such as identity theft and targeted phishing attacks against employees or customers may be observed. Because the organization is based in Thailand, compliance processes with local data protection regulations and potential legal sanctions may arise following such an incident.

The group known as Lynx has shown code similarities with INC Ransom, which suggests that the group may employ double extortion strategies using similar methods. This connection highlights the evolving nature of ransomware groups that share technical tools or methodologies to maximize their effectiveness.

For organizations operating in the professional services and luxury goods sectors, maintaining robust defensive postures is critical. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training for employees to prevent initial access via phishing. Furthermore, monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are essential components of a modern cybersecurity strategy.

Summary of the claim

• Target: jimthompson.com
• Threat Actor: Lynx
• Claimed Data Size: 203 GB
• Ransom Demand: $5,700,000
• Claimed Attack Date: December 8, 2024
• Announcement Date: January 7, 2025