Ransomware group
Lynx ransomware: victims and leak site activity
The Lynx ransomware group has listed 417 victims on its leak site since July 2024; its latest post is from 29 August 2026. Most affected countries: United States, United Kingdom and Canada. Most targeted sector: Manufacturing.
Total posts
417
First seen
2024-07-29
Latest post
2026-08-29
Countries hit
48
About Lynx
Lynx is a ransomware-as-a-service operation that emerged in mid-2024 as a rebrand of INC Ransomware (whose source code was sold for $300,000 on the RAMP forum), claiming ~300 victims across manufacturing, business services, technology, and transportation with an 80/20 profit split for affiliates.
Most targeted countries
- United States 219
- United Kingdom 29
- Canada 22
- Germany 17
- Australia 16
- France 9
- Italy 9
- Singapore 8
- Spain 7
- Japan 7
Most targeted sectors
- Manufacturing 93
- Professional Services 89
- Technology 49
- Transportation 29
- Retail & E-Commerce 25
- Agriculture and Food Production 23
- Financial Services 23
- Healthcare 20
- Hospitality 17
- Energy & Utilities 15