Lynx ransomware group lists PHG CPAs (bushman.biz) on its leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: January 13, 2025

Lynx ransomware group claims data breach at PHG CPAs

The Lynx ransomware group has officially announced a data breach involving PHG CPAs (bushman.biz) on its dedicated leak site. According to the announcement posted on January 13, 2025, the threat actors claim to have successfully targeted the organization's network. This type of announcement is a common tactic used in double extortion ransomware campaigns, where attackers not only encrypt an organization's data but also threaten to publish sensitive information on public forums to pressure the victim into paying a ransom.

The threat actors claim that their unauthorized activities against the company's network took place as early as November 24, 2024. While the announcement was made in January, the timeline suggests that the attackers may have had access to the network for several weeks prior to the public listing. The group has published a notice that implies a ransom demand is being made in exchange for the attackers not releasing the company's data to the public.

Details of the claimed data exposure

While the specific volume of stolen data and the exact amount of the ransom demanded have not been disclosed by the group, the announcement included visual evidence to support their claims. The screenshot provided in the leak site announcement contains sample documents that appear to represent sensitive information related to the company's business operations.

Based on the provided evidence, the following types of data are reported to be involved in the breach:

• Financial documents
• Tax filings

The presence of such documents in a leak site announcement highlights the sensitive nature of the information handled by professional services firms. In many ransomware scenarios, attackers target specific file types that hold the highest leverage for extortion, such as tax records and financial statements.

About PHG CPAs

Prince Hansen Group, PLLC, operating under the domain bushman.biz, is a CPA firm located in Salt Lake City. The firm has a long-standing presence in the industry, boasting over 30 years of experience. They provide a comprehensive suite of professional accounting services to their clientele, which includes tax consulting, financial planning, business valuation, and payroll services.

Potential impact and industry implications

A data breach at a firm providing specialized accounting and financial consulting services like PHG CPAs carries significant risks. The exposure of sensitive financial data could potentially impact over 1,700 clients. For an organization based in the United States, such an incident may lead to legal repercussions under various state laws and federal regulations regarding data privacy and protection.

Beyond the immediate legal concerns, secondary risks are a major concern for both the firm and its clients. These risks include the potential for identity theft and the possibility of highly targeted phishing attempts directed at the affected clients. Furthermore, the organization may face significant damage to its professional reputation and disruptions to its operational processes.

From a technical perspective, the Lynx group has shown characteristics that warrant close observation. The group exhibits code similarity with INC Ransom, which may suggest that the Lynx group utilizes professional and highly targeted attack methods. This level of sophistication is often seen in groups that conduct extensive reconnaissance before launching an attack.

To mitigate such risks, organizations in the professional services sector typically focus on robust defensive strategies. These include implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, maintaining offline, encrypted backups is a critical component of a modern cybersecurity posture to ensure operational continuity in the event of a successful ransomware deployment.