Model Die & Mold listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: United States
• Sector: Manufacturing
• Announcement date: November 5, 2024

The Lynx ransomware group has listed Model Die & Mold on their dedicated leak site, claiming to have successfully exfiltrated the company's data. This announcement represents a common tactic used by modern cybercriminal organizations, where the threat actor publicizes the victim's identity to pressure the organization into meeting specific demands.

The alleged attack and claims by Lynx

The threat actor known as Lynx announced the leak of data belonging to Model Die & Mold on November 5, 2024. According to the post made by the group, the breach involves the compromise of confidential documents related to the company's manufacturing operations. The group has initiated a countdown timer on their platform, a common psychological tactic used in double extortion schemes to increase pressure on the victim.

In their announcement, the group also made a specific note regarding the company's financial standing, citing an annual revenue of 25 million dollars. This type of information is often used by ransomware groups to gauge the potential payout or to demonstrate their knowledge of the target's business scale. While the group has claimed the attack occurred on October 4, 2024, the details remain part of the group's unilateral claims.

Details regarding the leaked data

Regarding the specific contents of the breach, the group has not provided comprehensive details. The listing provides very limited information concerning the nature of the stolen files. The only descriptors provided by the threat actor are that the data is categorized as 'Confidential' and is labeled as 'Part 1'. No specific file types, total data sizes, or specific file counts have been disclosed in the public announcement.

About Model Die & Mold

Model Die & Mold, Inc. is a manufacturing company based in Michigan, United States. The organization specializes in the design and production of injection and compression molds. Given its role in the manufacturing sector, the company serves as a specialized component of the industrial supply chain.

Analysis and potential implications

This alleged leak may jeopardize the company's intellectual property and trade secrets. For a manufacturing entity, the exposure of sensitive technical documentation or operational data could potentially create secondary risks for supply chain partners who rely on the integrity and confidentiality of the company's designs and processes. Because the company is located in the United States, state-level data breach notification laws may be applicable depending on the nature of the information involved.

From a technical perspective, the code similarity observed between the Lynx group and INC Ransom suggests that this incident may have been carried out as part of a professional ransomware operation. Such groups often operate with a high degree of sophistication, utilizing advanced methods to penetrate networks and exfiltrate data.

In general, ransomware attacks involving data exfiltration—often referred to as double extortion—aim to damage a company's reputation and operational stability. To defend against such threats, organizations in the manufacturing sector often implement several defensive layers. These include robust network segmentation to prevent lateral movement, strict access controls to protect intellectual property, and comprehensive monitoring to detect unauthorized data transfers. Furthermore, maintaining an updated incident response plan is a critical component for mitigating the impact of a potential breach and ensuring compliance with regional legal requirements regarding data protection and notification.