Lynx ransomware group lists www.toc.co.jp on its leak site

• Ransomware group: Lynx
• Country: Japan
• Sector: Transportation
• Announcement date: December 6, 2025

The threat actor group known as Lynx has officially announced the listing of the Japanese organization www.toc.co.jp on its dedicated leak site. This announcement, made on December 6, 2025, marks a potential cybersecurity incident involving the organization, as the group claims that data belonging to the entity has been compromised during the attack.

Details of the claim

According to the announcement posted on the Lynx leak platform, the group targeted the organization on December 6, 2025. While the group has publicly claimed responsibility for the breach, specific details regarding the nature of the incident remain limited. The threat actor's claim suggests that unauthorized access to the organization's systems has resulted in the compromise of sensitive information.

In many ransomware scenarios, threat actors utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where groups post the names of their targets to increase visibility and reputational pressure. Such tactics are often part of a broader strategy intended to coerce organizations into meeting financial demands by threatening the public release of stolen information.

Status of the compromised data

At this stage, the specific contents and the volume of the data allegedly stolen remain unknown. The information provided by the threat actor does not include details regarding the total number of files or the specific size of the data set. Furthermore, no ransom demand has been publicly specified in the current listing.

The listing names no specific data types. The provided screenshot associated with the claim displays a 404 error page, which means that no specific details regarding the nature of the leaked data are currently available to the public or researchers. Without access to the actual leaked files, it is impossible to determine the exact scope of the information compromise.

About TOC Co., Ltd.

TOC Co., Ltd. is a real estate company based in Japan. The company is responsible for the operation and management of the TOC Building located in Tokyo. This large-scale complex is a significant facility that includes a variety of commercial spaces, such as office environments, retail shops, and venues designed for events.

Risk assessment and industry implications

The claim made by the Lynx group may pose a significant risk to the operational processes and the customer data managed by the organization. This group, which emerged in 2024, has been observed to share code similarities with INC Ransom, which suggests they may employ double-extortion tactics. Double extortion is a method where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information, threatening to leak it publicly if a ransom is not paid.

Because the organization operates within Japan, it may be subject to strict compliance requirements under the APPI (Act on the Protection of Personal Information). If the breach is eventually confirmed, secondary risks could manifest, such as identity theft or targeted phishing attacks directed at the organization's customers and employees. Such attacks often follow a breach, as stolen information can be used to craft highly convincing fraudulent communications.

For organizations operating in the transportation and real estate sectors, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, adhering to regional data protection regulations is a critical component of managing the risks associated with potential data exfiltration and subsequent extortion attempts.