Lynx ransomware group lists www.onahotels.com on its leak site

• Ransomware group: Lynx
• Country: Spain
• Sector: Hospitality
• Announcement date: September 4, 2025

Lynx ransomware group claims attack on Ona Hotels

The ransomware group known as Lynx has officially listed the Spain-based hospitality company, www.onahotels.com, on its dedicated leak site. This announcement, made on September 4, 2025, marks a significant escalation in the group's targeting of the service sector. According to the claims made by the threat actors, the organization's data has been encrypted, and the group asserts that proof of the breach is available for verification.

Ransomware attacks of this nature typically involve a process known as double extortion. In these scenarios, attackers do not merely encrypt an organization's files to disrupt operations; they also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the public exposure of proprietary or customer information. This tactic significantly increases the pressure on the targeted entity, as the consequences of a leak often extend far beyond immediate operational downtime.

Details of the claim and ransom demand

The announcement provided by the Lynx group on September 4, 2025, details a massive financial demand. The group has specified a ransom demand of 22,700,000 dollars in exchange for the decryption of the organization's systems and to prevent the release of data. While the group claims that the organization's data has been encrypted, they have not provided specific details regarding the types of leaked data involved in this incident.

The listing names no specific data types that have been stolen or compromised. This lack of detail is common in early-stage leak site announcements, where the primary goal is to announce the victim's name and the ransom amount to create immediate psychological and reputational pressure. Without specific information regarding the volume or nature of the data, the full scope of the potential breach remains unquantified at this stage.

About Ona Hotels

Ona Hotels is a Spain-based hotel chain and hospitality service provider. The organization operates a diverse portfolio of hotels and apartment hotels located in various holiday destinations. As a significant player in the hospitality sector, the company manages various services aimed at travelers and holidaymakers across multiple locations.

Potential impact and organizational risks

This incident may lead to significant disruptions in the organization's operational processes and poses a serious risk of exposing sensitive customer data. Because the entity is based in Spain, any successful data breach may result in substantial legal and administrative sanctions under the General Data Protection Regulation (GDPR). The regulatory framework in the European Union imposes strict requirements on how organizations must protect personal data and how they must report breaches to authorities.

The Lynx group is recognized as a Ransomware-as-a-Service (RaaS) structure that emerged in 2024. Technical analysis has noted that the group exhibits code similarities with the INC Ransom group, suggesting a shared lineage or methodology within the evolving RaaS landscape. Such structures allow developers to lease their malware to affiliates, who then carry out the actual attacks, making the ecosystem highly scalable and difficult to dismantle.

For the customers of the organization, secondary risks are a major concern. These include the potential for identity theft and the occurrence of targeted phishing attacks, where attackers use stolen information to craft highly convincing fraudulent communications. To mitigate these risks, it is often advisable for affected parties to enhance their security measures, such as implementing multi-factor authentication and remaining vigilant against suspicious communications.

For organizations operating within the hospitality sector, maintaining robust cybersecurity defenses is critical. This includes implementing regular data backups, ensuring consistent software patching, and conducting regular security awareness training for staff to prevent initial access via phishing. As attackers continue to target high-value service providers, the ability to detect and respond to unauthorized access quickly remains a primary defense against both operational disruption and data exfiltration.