Lynx ransomware group lists saacke.com on its leak site

• Ransomware group: Lynx
• Country: Germany
• Sector: Manufacturing
• Announcement date: October 20, 2025

Lynx ransomware group claims breach of SAACKE

The threat actor known as Lynx has published an announcement on its dedicated leak site, listing the German manufacturing company SAACKE as a victim. The announcement, which appeared on October 20, 2025, claims that the group has successfully gained access to the organization's internal systems.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their targets. By publicly naming a victim, these groups aim to damage the reputation of the targeted entity and increase the likelihood of a ransom payment. In such scenarios, the threat actor typically claims to have exfiltrated sensitive information from the victim's network prior to deploying encryption software.

Details of the alleged incident

According to the claim made by the Lynx group, the breach occurred on October 20, 2025. While the group has officially listed the organization on their platform, specific details regarding the scope of the alleged breach remain unavailable. Because the content of the provided screenshots could not be loaded, there is no detailed information available regarding the specific nature or the extent of the intrusion.

Regarding the information involved in this incident, the listing names no specific data types. There is no information available regarding the nature of the data involved in the breach, nor has any information been provided regarding the volume of files or the specific size of the data allegedly taken.

About SAACKE

SAACKE GmbH is a German family-owned company that has been in operation since 1931. The organization specializes in the development and manufacture of high-efficiency combustion and thermal energy systems. These systems are designed for both industrial and marine applications. The company's product portfolio includes burners, boilers, and complete heating solutions, with a strategic focus on energy efficiency, the reduction of emissions, and the utilization of alternative fuels.

Potential impact and risk assessment

This incident may have a negative impact on SAACKE's operational continuity. Given that the company is based in Germany, a potential data breach could lead to legal obligations under the European Union's General Data Protection Regulation (GDPR). Organizations facing such risks must navigate complex regulatory frameworks to ensure compliance regarding data protection and incident reporting.

Secondary risks associated with such breaches may include the potential use of leaked data for identity theft or targeted phishing attacks. Furthermore, the Lynx group shares code similarities with INC Ransom, which may suggest that the group could employ double extortion strategies. Double extortion is a tactic where attackers not only encrypt an organization's data but also threaten to leak sensitive information publicly unless a ransom is paid, thereby increasing the leverage held by the threat actor.

For organizations operating in the manufacturing sector, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.