Lynx ransomware group lists planetone-asia.com on its leak site

• Ransomware group: Lynx
• Country: Singapore
• Sector: Technology
• Announcement date: February 21, 2025

Lynx ransomware group claims breach of Planet One

The Lynx ransomware group has listed the Singapore-based technology company Planet One on its leak site, claiming to have exfiltrated the organization's data. This announcement marks a significant development in the ongoing threat landscape facing technology service providers in the region.

Details of the alleged attack

According to the announcement published by the threat actor known as Lynx on February 21, 2025, the group claims to have obtained a substantial amount of information. The group asserts that the data exfiltration occurred following a security incident that reportedly took place on January 16, 2025. The stolen information is currently being listed publicly by the group on their dedicated leak site.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten the victim with public disclosure. This pressure is intended to coerce the organization into paying a ransom to prevent the release of their proprietary or customer information.

Scope of the claimed data leak

The group's claims regarding the volume and quantity of the stolen information are specific, though the exact nature of the files remains unconfirmed. Based on the information provided by the attackers, the following details have been reported:

• Total claimed data size: approximately 147 GB
• Total number of files: 31,907 files

While the group has provided these metrics, the listing does not include a detailed breakdown of the specific data content or the types of files involved. No information regarding a ransom demand was provided in the announcement.

About Planet One

Planet One Pte Ltd is a technology company based in Singapore. The organization operates within the custom software development and IT services sector, providing various technological solutions to its corporate clients. As a provider of IT services, the company plays a role in the digital infrastructure of its clients, making the security of its own data and systems a critical component of its operational profile.

Potential risks and organizational implications

The claims made by the Lynx group may pose significant risks to the organization's operational continuity and data privacy. Depending on the actual content of the allegedly leaked data, several secondary risks may emerge, such as identity theft or targeted phishing attacks directed at the company's employees or its customers.

Furthermore, because the organization operates in Singapore, it may face legal obligations under the Personal Data Protection Act (PDPA) regarding the handling and protection of personal data. The potential for regulatory scrutiny is a common consequence for companies facing large-scale data breaches.

The situation is further complicated by the technical profile of the threat actor. The group's reported code similarities with INC Ransom suggest that the organization could be subjected to secondary extortion attempts. This complexity increases the difficulty of incident response and recovery.

For organizations in the technology and IT services sector, such incidents can lead to long-term negative impacts on commercial reputation and customer trust. To mitigate such risks, organizations typically focus on robust defensive measures, including multi-factor authentication, regular security audits, and comprehensive data encryption. Maintaining a strong security posture is essential to protecting both corporate intellectual property and the privacy of the clients they serve.