The Greenhouse People targeted by lynx ransomware group

• Ransomware group: lynx
• Country: United Kingdom
• Sector: Professional Services
• Announcement date: July 29, 2024

The Greenhouse People has been listed on the leak site of the lynx ransomware group. The threat actor claims that approximately 30 GB of data has been exfiltrated from the organization's systems.

The details of the alleged attack

The threat actor known as lynx published data belonging to The Greenhouse People on its leak site on July 29, 2024. According to the group's announcement, the attack may have occurred around July 16, 2024. The group claims that there are vulnerabilities within the company's Active Directory infrastructure, which they leveraged during the incident.

The listing provided by the group mentions the exfiltration of various types of information. Specifically, the group claims to have obtained encrypted files, Active Directory dumps, and various proof documents to support their claims of a successful breach.

Data involved in the leak

Based on the directory listings visible in the screenshots provided by the attacker, the data is claimed to include several sensitive categories of information. The following items are reportedly included in the exfiltration:

• Payroll records
• Accounting department files
• General documents
• Active Directory dumps

About The Greenhouse People

The Greenhouse People is a British company specializing in the sale and installation of greenhouses since 1989. They operate in the supply of garden greenhouses, greenhouse accessories, and related gardening equipment.

Analysis and potential implications

The allegedly exfiltrated data may pose secondary risks to the company's employees and operational processes. The exposure of payroll and accounting information could lead to identity theft or targeted phishing attacks against staff members. Because the company is based in the United Kingdom, the incident may be subject to investigation by data protection authorities under the UK GDPR.

The compromise of the company's Active Directory infrastructure may create a risk of persistent access across the entire system. When an attacker gains access to the Active Directory, they often obtain the ability to move laterally through the network and maintain a presence even if initial entry points are closed. This type of access is particularly dangerous as it targets the core identity management system of an organization.

Furthermore, the code similarity between the lynx group and INC Ransom suggests that the group may have adopted double-extortion tactics using similar techniques. Double extortion is a common ransomware strategy where attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information before encryption. The attackers then threaten to leak this data on public forums or leak sites if a ransom is not paid, thereby increasing the pressure on the victim.

In such scenarios, organizations often face significant challenges in managing the fallout. Beyond the immediate operational disruption caused by encryption, the threat of a data leak necessitates a robust incident response plan that includes legal, regulatory, and communication strategies. For professional services and companies handling sensitive employee and financial information, the risk of identity theft and targeted social engineering remains a primary concern following a breach of this nature.