Nactarome listed on lynx ransomware leak site

• Ransomware group: lynx
• Country: Italy
• Sector: Manufacturing
• Announcement date: July 10, 2025

Nactarome targeted by lynx ransomware group

The Italian manufacturing firm Nactarome has been listed on a ransomware leak site by the threat actor known as lynx. This announcement, which surfaced on July 10, 2025, indicates a potential security incident involving the organization. The threat actor claims to have successfully infiltrated the company's digital infrastructure, leading to an alleged data exfiltration event.

Details of the alleged attack

According to the post published by the lynx group, the attack is claimed to have occurred on July 9, 2025. The group asserts that they gained unauthorized access to the systems belonging to Nactarome. While the listing was discovered on July 10, 2025, the group's claim points to the breach taking place the previous day.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms by threatening to release sensitive information. This tactic is frequently associated with a strategy known as double extortion. In a double extortion scenario, attackers do not just encrypt a company's data to disrupt operations; they also steal sensitive information beforehand. The threat of leaking this stolen data—such as proprietary business information or employee records—serves as additional leverage to ensure payment, even if the victim has backups to restore their systems.

Status of the leaked data

At this time, no details regarding the specific nature of the allegedly leaked data have been provided by the threat actor. Furthermore, the provided screenshot indicates that the specific leak page is currently inaccessible, making it impossible to verify the contents of the claim through the source. The listing names no specific data types that have been compromised.

About Nactarome

Nactarome is a company that specializes in the development and manufacture of natural flavours, colours, and functional ingredients specifically for the food and beverage industry. Founded in 2018, the organization is headquartered in Bresso, Italy.

Risk assessment and industry implications

The lynx group, which emerged in 2024, is identified as a Ransomware-as-a-Service (RaaS) entity. Technical analysis has reported that this group exhibits code similarities with INC Ransom. This specific leak claim may pose a significant risk of exposure for operational data or employee information within Nactarome.

Because the organization is based in Italy, any confirmed data breach could trigger legal processes under the General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how organizations handle personal data and report breaches to authorities. Additionally, the incident may create secondary risks for the organization's supply chain partners and customers, as a breach in a manufacturing entity can often impact the broader network of vendors and clients who interact with them.

For organizations operating in the manufacturing and food production sectors, maintaining robust cybersecurity postures is critical. This typically involves implementing multi-factor authentication, maintaining regular offline backups, and conducting regular vulnerability assessments. Furthermore, as supply chain risks increase, companies must monitor for potential downstream effects if a key partner or supplier is compromised by a threat actor.