WDEF-TV listed on lynx ransomware leak site with massive ransom demand

• Ransomware group: lynx
• Country: United States
• Sector: Technology
• Announcement date: May 1, 2025

The threat actor group known as lynx has officially listed WDEF-TV on its ransomware leak site. According to the announcement made on May 1, 2025, the group claims to have successfully conducted a ransomware attack against the organization. In conjunction with the listing, the attackers have issued a significant ransom demand of 25.1 million dollars to avoid the public release of stolen information.

The claimed ransomware attack

The lynx group asserts that they have executed a ransomware attack against WDEF-TV, a claim they publicized by adding the organization to their dedicated leak site on May 1, 2025. The attackers claim to have encrypted the organization's data, effectively disrupting its ability to access critical information. To exert pressure on the victim, the group has threatened to publish the stolen data if the ransom demand is not met.

To support their claims of a successful breach, the group has provided visual evidence in the form of screenshots. These shared images purportedly show operational information belonging to the organization, as well as sensitive documentation related to its workforce. This tactic is a hallmark of modern ransomware operations, where attackers use the threat of public exposure to coerce victims into paying.

Data involved in the claim

The screenshots provided by the lynx group in their listing contain specific text from various documents. Based on the available evidence, the information appears to include:

• Employee contracts
• Legal documents

The presence of these documents suggests that the breach may have targeted sensitive internal administrative files rather than just general operational data.

About WDEF-TV

WDEF-TV is a CBS-affiliated television station that provides broadcasting services in the Chattanooga, Tennessee area. The station is operated by Morris Multimedia and is responsible for providing local news coverage alongside various syndicated programming to its audience.

Analysis and industry implications

The lynx group is assessed as a Ransomware-as-a-Service (RaaS) entity that first emerged in 2024. Analysts have noted that the group shares similarities with the INC Ransom group. The current situation involving WDEF-TV highlights the use of double extortion tactics, a method where attackers not only encrypt an organization's data to halt operations but also steal sensitive information to threaten its public release. This dual pressure aims to maximize the likelihood of a ransom payment by targeting both operational continuity and the organization's reputation.

The potential leakage of the data claimed by lynx poses significant secondary risks. For the employees whose information is involved, the exposure of contracts and legal documents could lead to identity theft and the compromise of personal privacy. Furthermore, because WDEF-TV operates within the United States, any confirmed data breach may trigger legal obligations under various state-level privacy laws and regulations.

For organizations operating within the broadcasting and media sectors, such incidents can have profound impacts. Beyond the immediate technical and financial costs of recovering from an attack, a breach can damage the organization's credibility and trust within the industry. To defend against such threats, organizations typically focus on robust backup strategies, strict access controls, and comprehensive employee training to mitigate the risk of initial entry. As ransomware groups continue to evolve, the threat of data exfiltration remains a primary concern for organizations managing sensitive personnel and legal information.