AMICIO Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations across Europe by combining data theft with public leak-site listings, turning operational disruption into a reputational and regulatory risk. In this climate, even smaller service firms can find themselves named without warning. On 7 March 2025 the lynx ransomware group listed AMICIO, a French call-centre operator, claiming to have exfiltrated internal files. The number of people affected remains unknown and public detail is limited, yet the listing alone is enough to place customers, employees and partners on alert.

Because call centres routinely process personal and commercial data on behalf of clients, any confirmed exposure could create lasting consequences for individuals whose information was held. This article sets out only what is known, what is claimed, and the practical steps people can take while fuller information is still pending.

Inside the incident

Public reporting states that AMICIO was listed by the lynx ransomware group on 7 March 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the duration of the intrusion, the volume of data taken, or any ransom demand—have been disclosed. The number of individuals whose information may be involved is recorded as unknown. At the time of writing, the listing itself constitutes an unverified claim by the threat actor; independent confirmation of the breach’s full scope has not been made public.

AMICIO’s registered address is given as 17 Rue des Grandes Terres, 92500 Rueil-Malmaison, and the company maintains at least one public website at www.amicio.fr. Beyond these basic facts, the incident record contains no additional timelines, file inventories or statements from the organisation itself.

The group behind it: lynx

Lynx is a ransomware operation that has appeared on public radar in recent years, typically employing a double-extortion model: encrypting systems while simultaneously stealing data and threatening to publish it on a dedicated leak site. Like many contemporary groups, it is understood to operate as a ransomware-as-a-service, allowing affiliates to carry out intrusions under a shared brand. Public reporting on prior campaigns shows a pattern of targeting mid-sized organisations across multiple sectors, followed by timed listings that increase pressure on victims.

In the present case the group claims to have taken internal files from AMICIO. No additional statements, screenshots or sample data specific to this victim have been released in the available record, so the claim remains just that—an assertion posted on the group’s infrastructure. Security researchers continue to track lynx activity, but attribution of any particular technique to this incident would be speculative and is therefore omitted here.

About AMICIO

AMICIO operates in the activities of call centres sector. Call-centre businesses typically manage inbound and outbound customer communications for client companies, which means they often hold contact details, account references, call recordings, scripts and related operational records. The firm is based in Rueil-Malmaison, a suburb of Paris, and maintains an online presence through its website.

A breach at a call-centre provider is consequential because the data it processes frequently belongs to third parties—end customers of the clients it serves—as well as its own employees and contractors. Even limited internal files can contain enough personal or commercial information to enable social-engineering attacks or identity misuse. The absence of confirmed victim numbers does not reduce the potential impact; it simply means the full picture is still incomplete.

What was likely exposed

The only data category named in the public record is “internal files exfiltrated in ransomware attack.” Exact contents, file counts and whether personal data of customers or staff were included have not been disclosed. Organisations of this type commonly store employee records, client contracts, call logs, customer contact lists and operational documentation. It is therefore reasonable to expect that some combination of those materials could be among the files claimed by the group, yet nothing more specific can be stated as fact. Readers should treat any subsequent claims of particular data types as unconfirmed until corroborated by the organisation or independent investigators.

What's at stake

For individuals whose details may appear in the taken files, the principal risks are phishing, social engineering and, in the worst case, identity fraud. Call-centre data often includes names, phone numbers, email addresses and account identifiers that can be used to craft convincing follow-up scams. Employees face similar exposure of personal and payroll information. For AMICIO itself the stakes include operational disruption, potential contractual liabilities to its clients, and the longer-term cost of forensic investigation and remediation. Because the scale remains unknown, both the organisation and any affected parties must prepare for a range of outcomes rather than a single confirmed figure.

What to do if you're exposed

If you have done business with AMICIO or believe your data may have been held by the company, begin by monitoring financial and email accounts for unusual activity. Enable multi-factor authentication wherever available and treat unsolicited calls or messages that reference the firm with caution. Consider placing a fraud alert with credit-reference agencies if you are in a jurisdiction that offers that service. Finally, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; doing so provides an early indication of whether further protective steps are warranted while official notifications are still pending.

AICompiled with AI assistance from public sources and published under our editorial standards.