Lynx
An INC Ransom-derived crew; double extortion with a polished leak site.
Claimed victims
260
Top region
US
Top sector
Healthcare
Suspected origin
Unattributed
Latest claimed victims
Victims as claimed by the group on its leak site and tracked in our graph — claims are not independently verified, and listing here is not confirmation a breach occurred.
| Date | Organisation (claimed) | Sector | Country |
|---|---|---|---|
| 2026-08-29 | cutlercapital | Financial Services | — |
| 2026-08-06 | www.jerryleigh.com | Other | US |
| 2026-08-06 | www.talbotdes.org | Other | GB |
| 2026-06-18 | www.someco.com | Not Found | — |
| 2026-06-18 | www.eastersealsia.org | Healthcare | US |
| 2026-06-18 | www.wolfconstruction.net | Manufacturing | US |
| 2026-06-11 | www.commonwealth-partners.com | Professional Services | GB |
| 2026-05-10 | lifelongaccess.org | Healthcare | US |
| 2026-05-10 | st-annes.uk.com | Education | GB |
| 2026-05-10 | bayareaherbs.com | Retail & E-Commerce | US |
Regions targeted
US 9GB 4IN 1TW 1DE 1ES 1
Sectors targeted
Healthcare 3Manufacturing 3Financial Services 2Technology 2Retail & E-Commerce 2Construction 1
Suspected affiliates & lineage
Ransomware crews share affiliates, tooling and operators; brands fall and reappear under new names. Related to:
Track it daily
Ransomware moves every day. So does our paper.
The Probably Fine Daily is our morning threat-intelligence briefing — new victims, new groups, what actually matters, in plain English. Free.
Read today's Daily →Browse the archiveDefender-oriented threat intelligence. Nothing here assists an attack. Attribution and lineage reflect open-source reporting.