Doumen Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list mid-sized logistics and industrial firms on leak sites as part of double-extortion campaigns, a pattern that has become routine across Europe. Against that backdrop, the appearance of Doumen on a ransomware group’s site in mid-March 2025 is one more data point in an ongoing wave of claims against companies that move goods and manage supply chains.

On 14 March 2025 the ransomware group known as lynx publicly listed Doumen, a French family-owned transportation and logistics firm. Public reporting states that internal files were exfiltrated in a ransomware attack; the number of people affected and the precise contents of the files remain undisclosed. The listing itself is a claim by the group and has not been independently confirmed in the available record.

Breaking down the breach

The only confirmed public details are that Doumen was listed by lynx on or around 14 March 2025 and that the group asserts internal files were taken during a ransomware incident. No technical description of the intrusion method, no timeline of when systems were first compromised, and no figure for the volume of data or number of individuals involved have been released. The available summary simply notes that internal files were allegedly exfiltrated. Everything beyond that single assertion is unconfirmed.

The group behind it: lynx

Lynx is a ransomware operation that became publicly visible in 2024. Like many contemporary groups it follows a double-extortion model: encrypting systems while also claiming to steal data and threatening to publish it if a ransom is not paid. The group maintains a leak site on which it posts victim names and, in some cases, sample files. Public reporting has linked lynx to attacks on organisations across manufacturing, logistics and professional services, though each listing remains a claim until independently verified. In the Doumen case the group has asserted that internal files were taken; no further statements specific to this victim appear in the public record.

Doumen and its sector

Doumen, formally the Doumen Group, is a family-owned French company founded in 1915. It operates branches in Périgueux, Bordeaux, Villeneuve-sur-Lot, Nîmes and Avignon and employs more than 600 people. Its business centres on transportation, logistics and material handling, offering customers a range of solutions for moving and storing goods. Firms of this type routinely manage shipping schedules, warehouse inventories, customer contracts, employee records and operational correspondence. A breach that reaches internal files therefore has the potential to touch both commercial and personal information, which is why such incidents attract attention even when exact data volumes stay unknown.

What was likely exposed

The only data type named in public reporting is “internal files” said to have been exfiltrated. Exact contents have not been disclosed. Organisations in transportation and logistics typically hold material such as:

• Employee personnel and payroll records
• Customer and supplier contact details and contracts
• Shipment and inventory databases
• Operational correspondence and internal planning documents

Whether any or all of these categories were among the files taken remains unconfirmed. No sample files or detailed inventory has been published in the sources available for this account.

What's at stake

For individuals whose information may have been present in internal files, the practical risks include possible misuse of contact details, employment data or financial identifiers if those elements were present. For Doumen the stakes include operational disruption, potential regulatory scrutiny under European data-protection rules, and the need to notify affected parties once the scope is clarified. Because the number of people affected is listed as unknown and the precise data types remain unconfirmed, the full extent of harm cannot yet be measured. The organisation’s long history and multi-site footprint mean any recovery effort would need to cover several locations and a workforce of more than 600.

Were you affected?

If you have worked for, contracted with or supplied Doumen, treat the possibility of exposure seriously until more detail emerges. Practical first steps include monitoring financial and email accounts for unusual activity, changing passwords on any systems that may have shared credentials with Doumen-related services, and requesting confirmation from the company about whether your data was involved once official notifications begin. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Public information about this incident remains limited; further clarity will depend on statements from Doumen or independent verification of the files claimed by lynx.

AICompiled with AI assistance from public sources and published under our editorial standards.