Novati Constructions listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Australia
• Sector: Professional Services
• Announcement date: January 13, 2025

Lynx ransomware group claims data breach at Novati Constructions

The threat actor known as Lynx has officially listed the Australian-based company Novati Constructions on its dedicated leak site. This announcement, made on January 13, 2025, constitutes a claim of a successful cyberattack and subsequent data breach against the organization. By appearing on the group's platform, the attackers are signaling that they have allegedly compromised the company's internal systems and exfiltrated sensitive information.

Details of the alleged attack

According to the claims made by the Lynx group, the breach occurred on November 6, 2024. The group asserts that they have gained unauthorized access to the company's network, allowing them to bypass security measures and access internal files. While the group has published a listing, they have not provided specific details regarding the total volume of data stolen or the exact number of files compromised during the incident. Furthermore, no ransom demand has been publicly disclosed in the announcement.

The group's announcement includes screenshots intended to serve as proof of the breach. These images reportedly contain samples of documents that demonstrate the attackers' access to the company's internal environment. However, the full scope and exact contents of the leaked data remain unverified, as the group has not provided a comprehensive inventory of the stolen information.

Potentially affected data types

Based on the evidence provided in the leak site announcement, the following types of information have been identified as potentially compromised:

• Business correspondence
• Construction process documents

The presence of these documents suggests that the attackers have accessed files related to the day-to-day operations and project management aspects of the firm. It is important to note that no detailed information regarding the full scope of the leaked data has been provided by the threat actor.

About Novati Constructions

Novati Constructions is a privately owned family company based in Australia that has been operating since 1971. The organization specializes in serving as a head building contractor for the construction of new buildings. Throughout the entire construction process, from the initial stages to completion, the company is responsible for coordinating the efforts of various stakeholders, including suppliers, consultants, project managers, laborers, and various tradespeople.

Analysis and potential impact

The claim made by the Lynx group carries significant implications for Novati Constructions. The exposure of business correspondence and construction records could negatively impact the company's commercial reputation and its ability to maintain operational continuity. Furthermore, the leak of such documents introduces secondary risks to the company's broader ecosystem. Specifically, the supply chain partners and employees of the organization may face increased risks of identity theft or targeted phishing attacks if their information is included in the stolen datasets.

From a regulatory perspective, the company may be required to fulfill specific data breach notification obligations under Australian data protection regulations. The nature of the threat also highlights the evolving tactics of modern ransomware groups. The Lynx group, which emerged in 2024 and exhibits similarities to the INC Ransom group, appears to utilize double-extortion tactics. This method involves both encrypting the victim's data and threatening to publish it on a public leak site to increase pressure on the target.

In such scenarios, if a company does not comply with the attackers' demands, there is a high possibility that further data will be published. To defend against such threats, organizations in the professional services and construction sectors should prioritize robust security frameworks. This includes implementing strict access controls, maintaining comprehensive backups, and conducting regular employee training to recognize phishing attempts. Given the complexity of construction projects involving many different parties, ensuring secure communication channels and verifying the security posture of all partners is also a critical defensive step.