Stürmer Maschinen listed on lynx ransomware leak site

• Ransomware group: lynx
• Country: Germany
• Sector: Manufacturing
• Announcement date: February 24, 2025

German manufacturer Stürmer Maschinen targeted by lynx ransomware group

The German machinery manufacturer Stürmer Maschinen has been listed on the leak site of the threat actor group known as lynx. The group has claimed responsibility for a data breach involving the organization, alleging that a significant amount of sensitive information has been compromised during the attack.

Details of the alleged attack

According to the announcement published on the lynx leak site on February 24, 2025, the threat actors claim to have gained unauthorized access to the Stürmer Maschinen network on February 8, 2025. This indicates that the attackers may have maintained presence within the network for approximately two weeks prior to the public announcement of the data theft.

The group claims that the volume of stolen data amounts to 800 GB. While the total number of files has not been specified, the group asserts that the compromised dataset contains critical operational data belonging to the company. Ransomware leak sites are frequently used by cybercriminals to pressure victims into paying ransoms by threatening to release sensitive information to the public or to industry competitors.

Scope of the compromised data

The information provided by the threat actor includes screenshots of file directories, which suggest the presence of various sensitive folders. These directories include names such as 'Controlling', 'EDV', 'GF-Einzelhandel', 'GF-Fin', and 'VL Druckluft'. Because the full extent of the content has not been verified, the exact nature of the leaked files remains unclear.

Based on the available information, the compromised data is reported to include:

• Corporate financial data
• IT infrastructure files
• Administrative documents

About Stürmer Maschinen

Stürmer Maschinen is a German-based organization specializing in the manufacturing of machinery. Their product portfolio focuses on metalworking and woodworking machinery, as well as compressed air technology. The company serves a wide range of industrial and commercial clients through its diverse product offerings.

Potential risks and industry implications

This alleged leak may pose significant risks to the operational continuity and commercial reputation of Stürmer Maschinen. Given that the organization operates within Germany, the compromise of personal or commercial confidential data could lead to legal repercussions under the General Data Protection Regulation (GDPR). Organizations facing such threats often find themselves under strict obligations to fulfill data breach notification requirements and to inform all affected parties.

The lynx group has shown code similarity to the INC Ransom group, which suggests they may employ double-extortion tactics. In a double-extortion scenario, attackers not only encrypt the target's systems to disrupt operations but also steal sensitive data to use as leverage for extortion. This tactic introduces secondary risks for the organization, its employees, and its business partners, including the potential for identity theft or highly targeted phishing attacks.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Defensive strategies typically involve maintaining offline backups, implementing strict network segmentation to prevent lateral movement, and enforcing multi-factor authentication across all access points. Furthermore, continuous monitoring of network traffic can help detect unauthorized access before large volumes of data can be exfiltrated.