Societatea Energetica Electrica S.A. listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Romania
• Sector: Energy & Utilities
• Announcement date: February 12, 2025

The Romanian energy provider Societatea Energetica Electrica S.A. has been listed on the leak site of the Lynx ransomware group. The threat actor claims that the organization has been targeted in a ransomware attack, alleging that operational data has been compromised during the incident.

The claims made by the Lynx ransomware group

According to the announcement posted on the Lynx leak portal, the group claims to have successfully executed a ransomware attack against Societatea Energetica Electrica S.A. The threat actors assert that they have gained access to the company's internal information and are in possession of operational data. To support these allegations, the group has released several screenshots of documents that are purportedly belonging to the organization.

In many modern ransomware campaigns, threat actors utilize a technique known as double extortion. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data. The threat actors then threaten to leak this stolen information on public forums or specialized leak sites if the ransom demands are not met. This tactic increases the pressure on organizations by threatening their reputation and legal standing.

While the group has provided visual evidence through screenshots, there is no detailed breakdown provided by the attackers regarding the full scope of the breach or the specific types of data that have been compromised. The listing does not specify the total volume of data stolen or the exact nature of the files shown in the screenshots.

Affected data and evidence provided

The evidence provided by the Lynx group consists of screenshots of various documents. These files are claimed to be related to the operational processes of the organization. Based on the information available from the leak site, the following data types are identified as being affected:

• Corporate documents

It is important to note that the attackers have not provided a comprehensive inventory of the stolen files. No information was provided regarding the total size of the data breach or the specific number of files involved in the incident.

About Societatea Energetica Electrica S.A.

Societatea Energetica Electrica S.A. is a leading energy company operating in the field of electricity distribution and supply in Romania. The company provides essential services such as electricity management, tariff administration, metering, and billing across various regions of the country.

Analysis and potential implications

The involvement of the Lynx group presents several significant concerns. Technical analysis suggests a code similarity between the Lynx group and INC Ransom, which indicates that the group's operational capacity and methods may be sophisticated. Such sophistication often characterizes advanced persistent threat actors capable of navigating complex corporate networks.

Given the role of Societatea Energetica Electrica S.A. within the energy sector, this incident could pose risks to critical infrastructure security and operational continuity. Attacks on energy providers are particularly sensitive due to the essential nature of the services they provide to the public and the economy.

Furthermore, because the company is based in Romania, the incident may lead to legal and regulatory consequences under the EU General Data Protection Regulation (GDPR). If the leaked documents contain employee or customer information, it is possible that secondary risks, such as identity theft and targeted phishing attacks, may arise. Organizations in this sector often implement defensive measures such as network segmentation, multi-factor authentication, and continuous monitoring to mitigate such risks.