Lynx ransomware group lists www.dimarcogroup.com on its leak site

• Ransomware group: Lynx
• Country: Italy
• Sector: Manufacturing
• Announcement date: September 2, 2025

Lynx claims data breach against DiMarco Group

The threat actor known as Lynx has listed www.dimarcogroup.com on its leak portal, alleging that the organization has been the victim of a data breach. This announcement, which appeared on the group's dedicated leak site, marks a new development in the group's ongoing activities targeting various organizations.

The listing was officially announced on September 2, 2025. According to the information provided by the threat actor, the attack is claimed to have occurred on the same day, September 2, 2025. While the group has taken responsibility for the incident through its public announcement, the specific details regarding the nature of the intrusion remain limited to the group's own claims.

Details of the claim

The announcement published by Lynx provides a general overview of the situation but lacks granular technical details. The group has released a statement detailing the operations of the targeted organization, yet they have not disclosed specific information regarding the ransom demand. There is no mention of a specific monetary amount that the group is seeking from the victim.

Furthermore, the announcement does not provide information regarding the volume of data involved in the alleged breach. The group has not disclosed the total size of the data or the specific file count that has been targeted or exfiltrated. The listing serves as a public claim of the breach, intended to exert pressure on the organization.

Information regarding the leaked data

Regarding the content of the breach, the available records and screenshots do not provide specific details concerning the actual content of the leaked data. The information provided by the threat actor is limited to a general description of the organization's activities rather than a catalog of stolen files or sensitive information types.

• The listing names no specific data types.

About the DiMarco Group

The DiMarco Group is a comprehensive development company with a long history, having been founded in 1910. The organization provides a wide range of services, including real estate development, construction management, facilities management, and the provision of construction equipment. The company is headquartered in Rochester, New York.

Risk assessment and implications

The announcement by the Lynx group suggests that the organization's sensitive data may be at risk. For an organization noted to be based in Italy, this situation may trigger significant legal and regulatory implications. Specifically, data protection obligations and potential administrative sanctions under the General Data Protection Regulation (GDPR) may arise as a result of the alleged breach.

Beyond the immediate regulatory concerns, the organization faces several secondary risks. These include the potential for identity theft or the occurrence of targeted phishing attacks directed at the organization's employees and customers. Such attacks often follow a data breach, as threat actors use stolen information to craft highly convincing social engineering campaigns.

The Lynx group, which emerged in 2024, has been noted for sharing code similarities with INC Ransom. Based on these characteristics, it is assessed that the group may tend to utilize double-extortion tactics. In a double-extortion scenario, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to threaten its public release, thereby increasing the pressure on the victim to pay the ransom.

For organizations in the manufacturing and development sectors, maintaining operational continuity is a primary concern. Such attacks aim to disrupt these processes by creating uncertainty and potential downtime. To mitigate these risks, organizations typically focus on robust data protection strategies, continuous monitoring, and comprehensive incident response plans to address both the technical and regulatory consequences of a potential breach.