Lynx ransomware group targets derichsukonertz.de

• Ransomware group: Lynx
• Country: Germany
• Sector: Manufacturing
• Announcement date: May 2, 2025

The threat group known as Lynx has officially listed the German manufacturing company derichsukonertz.de on its dedicated leak site. According to the group's announcement, the organization has fallen victim to a cyberattack involving significant data exfiltration.

The claims made by Lynx

On May 2, 2025, the Lynx group published an announcement on its leak site alleging a successful breach of derichsukonertz.de. The threat actors claim that they have successfully encrypted the organization's systems, effectively disrupting their digital operations. Beyond the encryption of local files, the group alleges that they have exfiltrated a substantial amount of data from the company's network.

To prevent the public release of the stolen information, the attackers have issued a ransom demand. The group is demanding a payment of 13,000,000 USD. The group's claim suggests that the attack may have occurred as early as February 19, 2025, though the official announcement on the leak site was made several months later.

Details regarding the alleged data breach

The scale of the alleged theft is significant, with the Lynx group claiming to have stolen 1.8 TB of data. While the group has not provided a detailed list regarding the specific content of the allegedly leaked files, it is assessed that this volume of data may contain various corporate documents.

The listing does not specify the exact file types or the specific categories of information contained within the 1.8 TB of data. However, the sheer volume of the exfiltrated data suggests a broad impact on the organization's digital assets.

About derichsukonertz.de

F. J. Derichs, operating under the domain derichsukonertz.de, is a German company with a long history in the industrial sector. Operating since 1967, the firm specializes in the manufacturing of gears for various industrial sectors. Their service offerings include custom production and retrofitting services, which range from precision measuring pinions to heavy-duty drive systems, often produced based on technical drawings or specific samples provided by clients.

Potential impacts and industry implications

Given that the organization operates within the manufacturing sector, the leaked data may include sensitive items such as trade secrets, technical drawings, and customer information. Such a breach can lead to a significant loss of competitive advantage and cause substantial operational disruptions for the organization. Furthermore, because the entity is based in Germany, a potential data breach may result in legal sanctions under the General Data Protection Regulation (GDPR).

If the stolen data is eventually published by the threat actors, secondary risks may emerge, such as identity theft or targeted phishing attacks directed at the organization's employees and business partners. The methods used by the Lynx group appear to align with a double-extortion strategy, a common tactic used by Ransomware-as-a-Service (RaaS) groups. In this strategy, attackers not only encrypt the victim's data to disrupt operations but also threaten to leak the stolen data to pressure the victim into paying.

Organizations in the manufacturing sector can mitigate such risks by implementing robust security frameworks. This includes maintaining offline backups, enforcing strict access controls, and conducting regular security audits. Monitoring for unauthorized data exfiltration and ensuring compliance with regional data protection laws are also critical components of a modern cybersecurity posture.