Planet One listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Singapore
• Sector: Technology
• Announcement date: February 24, 2025

Lynx ransomware group targets Planet One

The Lynx ransomware group has listed the technology company Planet One on its leak site, claiming to have exfiltrated its data. This announcement, made via the group's dedicated leak portal, marks a new instance of a targeted cyberattack against a firm operating in the technology and software services sector.

Ransomware attacks often follow a pattern of double extortion, where threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage. By publishing stolen data on a public leak site, these groups aim to pressure the victim into paying a ransom to prevent the further dissemination of their proprietary or personal information.

Details of the claimed attack

According to the claims made by the Lynx group, the incident occurred on February 21, 2025. The group asserts that they successfully gained access to the institution's systems and subsequently shared the information publicly. The announcement regarding this data breach was officially posted on the group's leak site on February 24, 2025.

The group claims to have compromised a significant volume of information. The specific details provided by the attackers regarding the stolen assets include:

• A total dataset size of approximately 147 GB
• A file count consisting of 31,907 files

While the group claims to have gained access to the institution's systems, the exact nature of the breach and the methods used to infiltrate the network remain unconfirmed by the victim.

Potential data content and organizational profile

The exact content of the leaked data has not been specified by the attackers. However, given the nature of the organization's operations, it is possible that sensitive data such as trade secrets, customer information, or software source code may be included in the stolen files. The breach involves a dataset that may contain various types of operational and corporate data.

Planet One Pte Ltd is a Singapore-based technology company. The organization operates within the custom software development and IT services sector, providing specialized technical solutions and services.

Risk assessment and industry implications

This incident may pose a risk of exposure for the personal data of Planet One's employees and customers. Because the institution is based in Singapore, the incident may need to be evaluated under the Singapore Personal Data Protection Act (PDPA). Such regulatory frameworks often dictate how companies must handle and report the compromise of personal information to protect individual privacy.

Technical observations regarding the threat actor suggest that the Lynx group may utilize advanced intrusion techniques, as evidenced by code similarity between the Lynx group and INC Ransom. This capability suggests a sophisticated level of technical proficiency in bypassing security measures.

For organizations operating in the technology and software services sector, this situation could potentially impact supply chain security. When a service provider is compromised, the breach can ripple through their client base, potentially exposing downstream partners to secondary risks. Organizations facing such threats may need to take precautions against risks such as identity theft and targeted phishing attacks, which often follow the public exposure of corporate or personal data.

To defend against such threats, organizations typically implement multi-layered security strategies. This includes robust access controls, continuous monitoring of network traffic to detect unauthorized intrusions, and comprehensive employee training to mitigate the risk of phishing. Additionally, maintaining regular, offline backups and ensuring rapid incident response protocols are essential components of a modern cybersecurity posture designed to mitigate the impact of ransomware and data exfiltration.