Lynx ransomware group targets ossistemes.com

• Ransomware group: Lynx
• Country: Spain
• Sector: Technology
• Announcement date: May 10, 2026

Lynx ransomware group targets ossistemes.com

The Lynx ransomware group has listed the Spain-based technology company ossistemes.com on its leak site, claiming to have compromised the organization's data. This announcement, made on May 10, 2026, marks a significant escalation in the threat actor's activities against the technology sector.

Details of the claimed attack

According to the information provided by the threat actor, the group gained access to the systems of ossistemes.com on May 10, 2026. The attackers claim to have successfully infiltrated the organization's network and obtained various datasets. Following the breach, the Lynx group issued a ransom demand totaling 5,000,000 USD to the organization.

Ransomware attack patterns often involve multiple stages of infiltration. In many modern cyberattacks, threat actors do not merely encrypt files to disrupt operations; they also focus on exfiltrating sensitive information. This tactic, known as double extortion, involves threatening to leak stolen data on public forums if the ransom is not paid. This method increases the pressure on the victim organization, as the threat of public exposure can lead to severe reputational and legal consequences.

Data types and information involved

The announcement made by the Lynx group specifies several categories of data that they claim to have stolen from the organization. The presence of an Active Directory (AD) dump and encrypted data was also mentioned in the leak.

• Contracts
• Financial data
• Confidential information
• Customer data
• HR records
• Active Directory dump

The exposure of such diverse datasets—ranging from internal financial records to sensitive human resources information—indicates a deep level of access within the target's infrastructure. When an attacker obtains an Active Directory dump, they gain a blueprint of the organization's user accounts, group memberships, and network structure, which can be used to facilitate further lateral movement or identity theft.

Organizational profile of ossistemes.com

OS Sistemes is a technology company that helps businesses bring their digital projects to life. They specialize in software development, network setup, and the design of custom technology solutions.

Impact and potential risks

This incident may negatively impact the organization's operational continuity and customer trust. Given the nature of the leaked data, employees and customers may face risks of identity theft or targeted phishing attacks. As the organization is based in Spain, GDPR-related data breach notification obligations and potential administrative fines may arise.

The code similarity between the Lynx group and INC Ransom suggests that the group may have adopted double-extortion tactics, indicating that the leaked data could pose a secondary risk. Such a scenario means that even if the organization recovers its systems from backups, the threat of data exposure remains a persistent danger.

For organizations in the technology sector, such incidents highlight the necessity of robust incident response plans. To mitigate the impact of such breaches, organizations typically need to initiate forensic investigations to determine the scope of the breach and notify the relevant regulatory authorities. Defensive strategies often include implementing multi-factor authentication, maintaining offline backups, and conducting regular security audits to identify vulnerabilities before they can be exploited by threat actors.