University of Chile listed on Lynx ransomware leak site

• Ransomware group: Lynx
• Country: Chile
• Sector: Education
• Announcement date: June 4, 2025

The Lynx ransomware group has listed the University of Chile on its leak site. According to the announcement, the threat actor claims to have gained access to the institution's data, marking a significant potential breach for one of Latin America's most prominent academic institutions.

The claimed attack event

The threat actor known as Lynx has posted the University of Chile on its leak platform. The group alleges that a cyber incident occurred on May 30, 2025. While the group claims to have successfully breached the institution, the specifics of the announcement appear to have encountered technical difficulties during the publication process. The content of the announcement in the provided screenshot appears as 'undefined', which suggests that the group may have experienced a technical issue while attempting to publish the details of the attack.

Ransomware attacks often involve a process known as double extortion, where attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive data to threaten its public release. This tactic is designed to increase pressure on the victim to pay the ransom. In such scenarios, leak sites serve as a public gallery where threat actors post the names of their victims to damage their reputation and coerce payment.

Data involved in the incident

At this time, there is no information available regarding the nature of the alleged leaked data. The text in the screenshot is marked as 'undefined', and the listing does not specify the volume of files or the specific types of data that have been compromised. Consequently, the listing names no specific data types.

The organization

The University of Chile, located in Santiago, is the oldest and most prestigious public university in the country. Known for its leadership and innovation in science, technology, social sciences, and the arts, it is recognized as one of the top universities in Latin America.

Potential implications and risks

This incident suggests that student and academic staff data within the university may be at risk. The potential exposure of such sensitive information can lead to various secondary risks, including the use of leaked data for identity theft or targeted phishing attacks. Furthermore, the institution's legal obligations under Chilean data protection regulations may be triggered by this alleged breach.

The Lynx group, which reportedly emerged in 2024, shares code similarities with INC Ransom, which may indicate that the group could employ similar tactics. Such similarities often suggest that different ransomware groups may share underlying infrastructure or development methodologies, making them harder to track and defend against.

For organizations in the education sector, such incidents can lead to significant disruptions to academic and administrative processes, potentially creating negative impacts on operational continuity. To mitigate such risks, organizations typically focus on strengthening defensive postures through robust backup strategies, multi-factor authentication, and continuous monitoring of network traffic. Implementing strict access controls and conducting regular security awareness training for staff and students are also standard defensive steps to prevent unauthorized access and reduce the likelihood of successful phishing attempts.