Lynx ransomware group lists www.cbsaust.org.au on its leak site

• Ransomware group: Lynx
• Country: Australia
• Sector: Education
• Announcement date: October 15, 2025

The Lynx ransomware group has listed the Australian non-profit organization CBS Tasmania on its dedicated leak site. This announcement follows a claim by the threat actor that they successfully targeted the organization's digital infrastructure.

The claimed attack details

According to a post published by the Lynx group on October 15, 2025, the group claims to have targeted the domain www.cbsaust.org.au. The threat actor alleges that they gained unauthorized access to the organization's systems on October 10, 2025. While the group has made this public claim on their leak site, the current status of the leak page itself is reported to be inaccessible, returning a 404 error according to provided screenshots.

Data involvement and specifics

At this time, the listing does not provide specific details regarding the nature or volume of the data involved in the alleged breach. No information has been provided regarding the specific types of files, the total size of the data, or the number of files stolen. The listing names no specific data types.

About CBS Tasmania

CBS Tasmania is a non-profit organization dedicated to providing personalized aged care and disability support services. The organization aims to enhance the independence and quality of life for its clients through various means, including home care packages, social activities, and home maintenance services.

Analysis and potential impact

The Lynx group is identified as a Ransomware-as-a-Service (RaaS) operation that emerged in 2024. Technical analysis has indicated that the group shares code similarities with the INC Ransom group. Given the nature of the services provided by CBS Tasmania, which include support for the elderly and individuals with disabilities, a confirmed breach could potentially involve the exposure of sensitive personal information belonging to vulnerable populations.

Such an incident may trigger legal proceedings under Australian privacy laws and data protection regulations. If sensitive data is indeed leaked, it could lead to significant risks for the service recipients, including identity theft and the possibility of targeted phishing attacks. Based on the known tactics of the Lynx group, the use of double extortion methods—where data is both encrypted and stolen to leverage further pressure—may be expected.

In general, ransomware leak sites serve as a platform for threat actors to pressure victims by threatening to release stolen information. When organizations face such threats, common defensive steps include implementing robust multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent initial access. For organizations in the healthcare and social support sectors, protecting sensitive client data is a critical component of maintaining trust and regulatory compliance.