Schmiedetechnik Plettenberg GmbH & Co KG targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: Germany
• Sector: Manufacturing
• Announcement date: March 5, 2025

The Lynx ransomware group has listed Schmiedetechnik Plettenberg GmbH & Co KG on its leak site, alleging that the organization has been the victim of a data breach. This announcement, made on March 5, 2025, marks a new instance of double extortion tactics being employed against industrial entities.

The alleged attack and claims by Lynx

According to the announcement posted on the group's leak portal on March 5, 2025, the Lynx group claims to have successfully breached the internal systems of Schmiedetechnik Plettenberg GmbH & Co KG. The threat actors assert that they have gained unauthorized access to the company's internal communications and various operational documents.

To support their claims of a successful intrusion, the group has published several documents on their portal. These files are presented by the attackers as proof of the breach, intended to pressure the organization into meeting their demands. In many such ransomware incidents, threat actors use this method of publicizing stolen data to increase the pressure on the victim, a tactic often referred to as double extortion, where data is not only encrypted but also stolen to be used for extortion purposes.

Details of the compromised data

While the group has provided evidence of the breach, the specific details regarding the full scope and the exact nature of the compromised data remain unclear. The group has not provided information regarding the total size of the data stolen or the specific number of files involved. Based on the available evidence, the following types of information have been identified as being affected:

• Corporate correspondence
• Operational documents

The evidence provided by the group includes screenshots of official correspondence and operational documents that feature the company's official letterhead. However, there is no detailed information available regarding the full extent of the compromised data or the specific contents of the files beyond these samples.

The target organization

Schmiedetechnik Plettenberg GmbH & Co KG is a manufacturing company based in Plettenberg, Germany. The company specializes in forging technologies and metal processing. Their primary business focus involves the production of various metal components designed for a wide range of industrial applications.

Risk assessment and industry implications

This incident suggests that the company may be at risk of having its trade secrets and critical operational data exposed to the public or other malicious actors. Because the organization is based in Germany, any potential data breach could lead to significant legal consequences under the General Data Protection Regulation (GDPR).

The reported similarity between the Lynx group and INC Ransom may indicate that the attack methods used in this instance could be sophisticated. Such sophistication often requires organizations to maintain high levels of vigilance. Furthermore, the breach poses secondary risks, such as the potential for the leaked data to be utilized by other threat actors in future campaigns.

For organizations in the manufacturing sector, such incidents highlight the vulnerability of employees and business partners to phishing or targeted social engineering attacks. When internal communications are compromised, attackers can often use the stolen information to craft highly convincing messages to impersonate company officials. To defend against such threats, organizations typically implement multi-factor authentication, conduct regular security awareness training for staff, and maintain robust, offline backups to mitigate the impact of ransomware encryption.