SCM Group listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Italy
• Sector: Manufacturing
• Announcement date: November 26, 2024

Lynx ransomware group claims data breach against SCM Group

The Italy-based manufacturing company SCM Group has been listed on the leak site of the Lynx ransomware group. According to the announcement made by the threat actor, the organization is facing a significant data leak involving a substantial volume of information. This development follows a period of alleged inactivity from the target organization, as the group claims that all attempts to contact the company's management were ignored.

The incident was officially announced on the group's leak site on November 26, 2024. While the exact timing of the initial intrusion remains unconfirmed, the group claims the attack occurred on November 11, 2024. This type of public listing is a hallmark of modern ransomware operations, where threat actors use the threat of data exposure to exert pressure on their victims.

Details of the claimed data leak

The Lynx ransomware group has made several claims regarding the scale and nature of the data they have allegedly exfiltrated from SCM Group. The group asserts that they have obtained a massive amount of information, specifically claiming a total data size of 700 GB. No specific file count was provided in the announcement.

The threat actor has provided visual evidence in the form of screenshots to support their claims. These screenshots display various file directories that are allegedly part of the stolen data. The identified directories include:

• ukfs1
• scmukfs2
• SCMNAFS1
• public
• doc_marketing
• BACKUP

The presence of a directory labeled 'BACKUP' is particularly concerning, as it suggests that the attackers may have targeted the organization's redundant data storage, which is often a primary goal in destructive cyberattacks.

About SCM Group

SCM Group is an Italian-based manufacturing company that specializes in the production of machinery and industrial solutions. Their product range is designed for processing various materials, including wood, plastic, stone, glass, and metal. The company is recognized for developing high-technology equipment and systems that serve a wide array of different industrial sectors.

Analysis and industry implications

This leak claim suggests that the organization's operational data and backups may be at risk. Because SCM Group is based in Italy, the incident may trigger legal obligations under the General Data Protection Regulation (GDPR), depending on the specific nature of the compromised data. The potential exposure of sensitive information often necessitates strict regulatory reporting and mitigation strategies.

The group behind this attack, Lynx, has shown characteristics that warrant close monitoring. There is noted code similarity between Lynx and the INC Ransom group, which indicates that Lynx may employ professional and destructive tactics during their campaigns. This connection suggests a level of sophistication often seen in organized cybercrime syndicates.

The strategy being employed here is known as double extortion. In a double extortion scheme, attackers do not just encrypt an organization's systems to disrupt operations; they also steal sensitive data and threaten to publish it online. This method is intended to exert maximum pressure on the organization, as the threat of a public leak can cause irreparable reputational damage and legal consequences, even if the company can restore its systems from backups.

The publication of the organization's data could increase the risk of secondary attacks. These secondary threats often include the exposure of employee and customer information, which can lead to targeted phishing campaigns, identity theft, or further exploitation of the supply chain. For organizations in the manufacturing sector, such incidents highlight the critical importance of robust cybersecurity frameworks, including regular offline backups, strict access controls, and continuous monitoring of network traffic to detect unauthorized data exfiltration.