Login
iscover
Share this article on:
Powered by
MOMENTUM
MEDIA
Powered by MOMENTUMMEDIA
Hackers say they have stolen records of “contracts, financial data, [and] incidents” from a Sydney-based firm.
The Lynx ransomware gang claims to have stolen business and personal data from Sydney-based construction firm Novati Constructions.
The company was listed on Lynx’s darknet leak site on 13 January, with the gang saying the exfiltrated data included “contracts, financial data, [and] incidents”.
No ransom amount was listed, though Lynx is threatening to publish the alleged data within four days. The gang also published several documents stolen during the alleged hack, including planning emails and client correspondence, tender results, and a death certificate. The gang did not share its ransom demand.
Novati Constructions has not responded to Cyber Daily’s request for comment.
Lynx was first observed in July 2024, when it first began sharing victims on its leak site. Since then, it has listed 100 victims, including Novati Constructions, which is one of seven victims shared on 13 January. The gang’s last Australian victim was Western Australia-based Myelec Electrical Wholesalers.
According to researchers from Palo Alto Networks’ Unit 42, Lynx is likely an offshoot of INC ransomware since their code shares several similarities. The group is known to use phishing emails to harvest a victim’s credentials and shop around for information on potential victims on underground hacking forums.
The group utilises double extortion tactics, first encrypting a victim’s data and then threatening to publish that data if payment is not forthcoming.
In a “press release” posted to its site last year, a Lynx spokesperson outlined the group’s motivations and beliefs.
“Lynx Ransomware core motivation is grounded in financial incentives, with a clear intention to avoid undue harm to organisations,” Lynx said.
“We recognise the importance of ethical considerations in the pursuit of financial gain and maintain a strict policy against targeting governmental institutions, hospitals, or non-profit organisations, as these sectors play vital roles in society.”
The gang also said it “encourages dialogue and resolution rather than chaos and destruction” and seeks to uphold “professional standards that prioritise transparency in communication and targeted interactions”.
Novati Constructions, based in Crows Nest in NSW, focuses on “new construction, refurbishment and heritage restoration within the Sydney basin”, particularly in the commercial, industrial, educational, and aged-care sectors. Its clients include Dicker Data, the Manly Civic Club, and Quest Apartments.
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.
Be the first to hear the latest developments in the cyber industry.
