Tryon targeted by Lynx ransomware group

• Ransomware group: Lynx
• Country: Italy
• Sector: Hospitality
• Announcement date: March 14, 2025

The Lynx ransomware group has posted an announcement on its leak site claiming to have successfully attacked Tryon Srl. According to the group's post, which was published on March 14, 2025, the organization's data has been compromised and a ransom demand has been issued.

The alleged ransomware attack

The announcement made by the Lynx group states that they have acquired data belonging to Tryon Srl. The group claims that the organization's files have been encrypted and has provided proof to support their claims. The attackers are reportedly demanding a ransom payment of $1,510,000 in exchange for the return of the data and to prevent further exposure.

In modern cyberattacks, this pattern is often associated with double extortion tactics. In such scenarios, threat actors do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this stolen data on a public leak site serves as additional leverage to pressure the victim into paying the ransom. This method significantly increases the pressure on an organization, as the threat extends beyond operational downtime to include long-term reputational and legal consequences.

Details of the claimed data leak

Based on the screenshots provided by the threat actor, the leaked data is claimed to be substantial, totaling approximately 8GB. The group asserts that the stolen information includes several categories of sensitive data, which are as follows:

• Contracts
• HR data
• Financial data
• Customer data

The exposure of such diverse data types suggests a significant breach of the company's internal information architecture. When sensitive files like contracts and financial records are targeted, it often indicates that the attackers have gained deep access to the corporate network.

About Tryon Srl

Tryon Srl is a restaurant business operating in the Veneto region of Italy. The company operates within the hospitality sector and employs approximately 50-99 people. Given its scale, the organization likely manages a variety of sensitive information ranging from employee records to customer transaction details.

Impact and potential risks

This alleged leak may negatively impact the company's operational processes and customer relations. Given the nature of the leaked data, the incident may lead to legal sanctions under GDPR regulations, as the exposure of personal and financial information is a primary concern for data protection authorities. Furthermore, the leakage of customer and financial data could potentially result in secondary risks such as targeted phishing or identity theft, where attackers use the stolen information to deceive individuals.

Interestingly, the group has reported code similarities with INC Ransom, which may indicate the complexity of the attack method employed in this incident. The sophistication of the tools used by ransomware groups can often determine the speed and effectiveness of the initial breach and subsequent lateral movement within a network.

For organizations operating in the hospitality sector, such incidents highlight the importance of robust cybersecurity frameworks. To mitigate these risks, companies often implement defensive measures such as regular offline backups, multi-factor authentication (MFA), and continuous monitoring of network traffic to detect unauthorized exfiltration. Additionally, maintaining a strict principle of least privilege can help limit the amount of data an attacker can access even if a single account is compromised. As ransomware groups continue to evolve, staying vigilant against complex attack methods remains a critical component of organizational defense.