Lynx ransomware group lists terport.com.py on its leak site

• Ransomware group: Lynx
• Country: Paraguay
• Sector: Transportation
• Announcement date: December 21, 2025

The Lynx ransomware group has published an announcement on its leak site listing the Paraguayan organization terport.com.py. The threat actor claims to have conducted a cyberattack against the entity, suggesting that the institution's operational data may have been compromised during the incident.

The claimed attack by Lynx

On December 21, 2025, the threat actor known as Lynx released a formal announcement on its dedicated leak site. This listing specifically names terport.com.py as a target of their operations. While the group has publicly claimed to have carried out a cyberattack against the organization, the specific details regarding the execution of the breach remain undisclosed by the attackers.

Ransomware leak sites serve as a platform for cybercriminals to exert pressure on their victims. By listing an organization, these groups aim to damage the victim's reputation and create urgency for ransom negotiations. In this instance, the listing serves as the primary evidence provided by the group to support their claim of a successful intrusion into the organization's network.

Details regarding the data involved

At this stage, the information provided by the threat actor is limited. No details regarding the nature of the leaked or threatened data have been provided by the group. Furthermore, the provided screenshot indicates that the relevant page on the leak site is currently inaccessible, making it difficult to verify the specific claims made by the attackers.

The listing names no specific data types that have been compromised or are being threatened for release.

About Terport

Terport is a leading container, general cargo, and RORO terminal operator operating on the Paraguay-Parana Waterway. Through its terminals in Villeta and San Antonio, it provides port services, warehousing, and bonded warehouse solutions.

Assessment and potential implications

This claim by the Lynx group suggests that sensitive data related to the organization's logistics and warehousing operations may be at risk. Based on the group's profile, which emerged in 2024 and shares code similarities with INC Ransom, it is assessed that they may employ double-extortion tactics. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release if a ransom is not paid.

A potential impact on the organization's operational continuity and trade secrets may be observed following such an attack. Furthermore, a breach of this nature could pose secondary risks to supply chain partners and customers. Because the organization operates within critical infrastructure involving waterways and terminal services, a disruption or data leak can have ripple effects throughout the logistics network.

For organizations operating in the transportation and logistics sectors, such incidents may necessitate a thorough review of the organization's data protection processes. Strengthening defensive postures often involves implementing robust backup strategies, enhancing network segmentation to prevent lateral movement, and maintaining rigorous monitoring of sensitive data access. Ensuring that supply chain partners are also aware of these risks is vital for maintaining overall ecosystem security.