Lynx ransomware group targets Browdy (bl.local) and FisherBroyles, LLP

• Ransomware group: Lynx
• Country: United States
• Sector: Professional Services
• Announcement date: January 13, 2025

Lynx ransomware group targets Browdy (bl.local)

The Lynx ransomware group has officially listed Browdy (bl.local) on its leak site. This listing is associated with the United States-based law firm FisherBroyles, LLP. The threat actor claims to have successfully compromised the institution's data and has issued a significant ransom demand following the alleged breach.

Details of the claimed attack

The threat actor known as Lynx published a ransomware announcement regarding Browdy (bl.local) on January 13, 2025. According to the group's claims, the attack occurred on the same day the announcement was made. The group is currently demanding a ransom of 5,000,000 dollars in exchange for not releasing the stolen information.

In an effort to substantiate their claims of a successful breach, the group has provided sample documents as proof of the alleged incident. These samples are intended to demonstrate that the attackers have indeed gained access to the organization's internal environment and have extracted sensitive information.

Evidence provided by the attackers

The content shared by the group includes specific visual evidence to support their claims. The screenshot shared in the announcement displays what appear to be legal correspondence and document samples related to the institution's operations. This type of evidence is a common tactic used by ransomware groups to pressure victims into paying the ransom.

Organization profile

FisherBroyles, LLP is a professional services firm operating within the legal sector. Founded in 2002, the firm is a full-service law firm that maintains various offices across the United States.

Risk assessment and industry implications

The targeting of law firms by ransomware groups presents a high level of risk due to the potential exposure of client confidentiality and sensitive legal documents. Because the institution operates within the United States, any potential data breaches could lead to significant legal sanctions under both state laws and federal regulations. The nature of legal work involves handling highly sensitive information, making these firms attractive targets for extortion.

The specific threat actor, Lynx, has shown code similarities with the INC Ransom group. This technical connection may indicate that Lynx employs professional and destructive methods during their operations. Beyond the immediate impact of the breach, several secondary risks must be considered:

• The possibility of the leaked data being used to facilitate identity theft.
• The potential for the stolen information to be used in targeted phishing attacks against the firm or its clients.
• The risk of the incident serving as a stepping stone for broader supply chain attacks, given the law firm's client portfolio.

Ransomware attacks often follow a