diyar.com Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 16, 2025, the architecture, engineering and design firm diyar.com was listed by the ransomware group known as lynx. Public reporting indicates that internal files were exfiltrated in a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed.

The listing places the organisation among those claimed as victims by the group. Because the scale, exact timing and full method of the intrusion have not been confirmed publicly, the practical consequences for clients, partners and staff cannot yet be measured with precision. What is known so far is limited to the group’s claim and the description of the data involved as internal files.

Breaking down the breach

According to the available record, diyar.com appeared on a lynx leak site on May 16, 2025. The group claims that internal files were taken during a ransomware attack. No public confirmation has been issued by the organisation itself regarding the intrusion, the volume of data removed, or whether systems were encrypted. The number of individuals whose information may have been involved is listed as unknown. Method of initial access, duration of the attackers’ presence and any ransom demand remain undisclosed. In short, the only concrete public elements are the listing date, the attribution to lynx, and the characterisation of the material as internal files exfiltrated in a ransomware incident.

Who is lynx?

Lynx is a ransomware operation that became publicly visible in 2024. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. The group maintains a leak site on which it posts victim names and, in some cases, sample files. Public reporting has associated lynx with attacks on organisations across multiple sectors, often after initial access obtained through compromised credentials, phishing or exploitation of exposed services. Its operators have not been publicly identified, and the group’s claims about individual victims are treated by investigators as assertions that require independent verification. In this instance the facts state only that diyar.com was listed; no additional statements by lynx about the firm have been recorded in the available material.

Who is diyar.com?

Diyar.com operates in the architecture, engineering and design sector. Firms of this type routinely handle project plans, technical drawings, client correspondence, contracts, financial records and employee information. Such material can include sensitive commercial details, intellectual property and personal data of staff and clients. A ransomware incident that involves the exfiltration of internal files therefore raises concerns about both operational continuity and the confidentiality of project-related and personal information. Because the organisation’s work intersects with construction, planning and professional services, any disruption or data exposure can affect not only the firm itself but also the third parties who rely on its designs and documentation.

What data was at risk

The facts name the exposed material simply as “internal files exfiltrated in a ransomware attack.” No further breakdown—such as whether the files contained personal identifiers, financial records, project blueprints or credentials—has been provided. Organisations in architecture, engineering and design typically store a mixture of proprietary design files, client contracts, employee records and administrative documents. Until more specific inventories are released, it is not possible to confirm which of these categories, if any, were among the files taken. The exact contents therefore remain unconfirmed.

The real-world impact

For individuals whose data may have been among the internal files, the primary risks are identity-related misuse, targeted phishing and, in some cases, exposure of professional or residential details. Because the volume and precise nature of the data are unknown, the severity of those risks cannot be quantified. For the organisation, the incident carries the usual consequences of a ransomware event: potential operational downtime, costs associated with investigation and recovery, possible regulatory notification obligations, and reputational effects among clients who entrust it with sensitive project information. None of these outcomes have been publicly detailed, so they remain potential rather than established.

Were you affected?

If you have worked with diyar.com as a client, partner or employee, treat any unexpected communications that reference the firm with caution and verify them through known official channels. Monitor financial and email accounts for unusual activity, and consider placing fraud alerts with credit-reporting agencies if you believe personal information may have been involved. Because the full scope of the data remains undisclosed, a practical next step is to run a free exposure scan of your email address against known breach datasets; this can indicate whether your details have already appeared in public or previously reported collections. Continue to follow official statements from the organisation for any further guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.