Diyar Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose personal or professional details sit inside the systems of an architecture, engineering and design firm may now face uncertainty about whether those details have been copied by criminals. On 16 May 2025 the ransomware group known as lynx publicly listed Diyar, the organisation behind www.diyar.com, claiming it had stolen internal files. The number of individuals affected remains unknown, and the precise contents of the material have not been confirmed by independent sources. For anyone who has worked with, contracted for, or supplied information to Diyar, the listing raises practical questions about identity exposure, potential fraud and the security of project-related records.

Because the claim originates from a criminal leak site rather than a verified disclosure by the company itself, the full scope is still unclear. What is known is limited to the group’s assertion that internal files were taken during a ransomware attack. That limited public record is enough to warrant careful attention from anyone who may have data held by the firm.

What happened

According to the public listing dated 16 May 2025, the lynx ransomware group claimed responsibility for an attack on Diyar in which internal files were exfiltrated. The organisation is identified simply as Diyar, operating the website www.diyar.com and working in architecture, engineering and design. No official confirmation of the intrusion, no statement of when the attack occurred, and no figure for the volume of data taken have been released in the available record. The number of people whose information may be involved is listed as unknown. Public detail on the method of entry, the duration of access, or any ransom demand is likewise undisclosed. The sole concrete assertion is the group’s claim that internal files were removed as part of a ransomware operation.

Inside lynx

Lynx is a ransomware group that became active in the public eye in 2024. Like many contemporary ransomware operations, it follows a double-extortion model: encrypting systems to disrupt operations while simultaneously copying data and threatening to publish it if payment is not made. The group maintains a leak site on which it names victims and, in some cases, releases samples or full archives of stolen material. Lynx has been observed targeting organisations across multiple sectors rather than specialising in a single industry. Its listings typically present the victim’s name, a brief description and a countdown or claim of data volume; these statements are self-reported by the criminals and are not independently verified at the moment of posting. Prior public activity by the group has included similar claims against companies of varying sizes, often accompanied by pressure tactics designed to force negotiation. In the present case the listing of Diyar is therefore treated as an unverified claim by the group rather than established fact.

Diyar and its sector

Diyar is described in the available summary as an architecture, engineering and design organisation reachable at www.diyar.com. Firms in this sector routinely handle project drawings, technical specifications, client correspondence, contractor details, financial records related to bids and contracts, and employee or consultant information. They may also store site photographs, building information models, and regulatory submissions that contain personal or commercially sensitive data. A breach at such an organisation can therefore touch both the firm’s own staff and a wider circle of clients, partners and suppliers who have shared documents or contact details in the course of normal business. Because the work often involves long-term projects and multi-party collaboration, records can accumulate over years, increasing the potential surface of any compromise. The listing by lynx places Diyar among the organisations whose internal material has been claimed by a ransomware actor, with the practical consequence that anyone who has interacted with the firm may need to consider the possibility of exposure.

What data was at risk

The only data type named in the public record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files included personal identifiers, financial documents, project plans, or employee records—has been disclosed. Organisations of this kind typically hold a mixture of business correspondence, design files, client contact lists, contracts, invoices and personnel data. It is therefore reasonable to expect that some combination of those categories could have been present on systems that were accessed. However, the exact contents remain unconfirmed. Public detail does not establish which specific files were taken, whether any personal data of private individuals was included, or how many records were involved. Until more information is released by Diyar or verified by independent investigators, the nature of the exposed material stays limited to the group’s general claim of internal files.

Why it matters

For individuals, the practical risks centre on the possible misuse of any personal or contact information that may have been among the internal files. Names, email addresses, phone numbers or identity documents can be used for targeted phishing, social-engineering attempts or account-takeover efforts. Project-related data, if present, could expose commercial details that competitors or fraudsters might exploit. For the organisation itself, the incident carries operational and reputational consequences: disruption from any encryption that accompanied the theft, the cost of investigation and recovery, and the need to notify partners or regulators if personal data is later confirmed to have been involved. Because the number of people affected is unknown and the precise data types are unconfirmed, the scale of these risks cannot yet be quantified. The calm response is therefore to treat the claim seriously while waiting for clearer information, and to take basic protective steps in the meantime.

Were you affected?

If you have worked with Diyar, supplied documents to the firm, or appear in its records as a client, contractor or employee, begin by monitoring financial and email accounts for unusual activity. Enable multi-factor authentication wherever it is available, and treat unexpected messages that reference architecture or engineering projects with caution. Consider changing passwords that may have been reused across services. You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Keep records of any suspicious contact and, if you believe personal data has been misused, report it to the relevant authorities in your jurisdiction. Further official statements from Diyar, if they are issued, will provide the most reliable guidance on next steps.

AICompiled with AI assistance from public sources and published under our editorial standards.