Farrar & Ball Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On December 21, 2024, the ransomware group known as lynx listed Farrar & Ball on its leak site, claiming to have carried out a ransomware attack that involved the exfiltration of internal files. Public reporting states that the material includes confidential information belonging to both the company’s clients and the firm itself. The number of people affected remains unknown, and further operational details have not been disclosed.

For clients, employees, and partners of Farrar & Ball, the listing raises practical questions about what data may now be in unauthorized hands and what steps can reduce personal risk. Because the claim originates from the threat actor’s own site, it should be treated as an unverified assertion until independently confirmed.

Breaking down the breach

According to the available record, Farrar & Ball was listed by the lynx ransomware group on December 21, 2024. The group asserts that it conducted a ransomware attack in which internal files were exfiltrated. The reported summary describes the material as confidential information of clients and of the company. No confirmed figure has been released for the number of individuals affected, and public detail on the precise timing of the intrusion, the initial access method, the volume of data taken, or any ransom demand remains undisclosed. The incident is therefore known primarily through the group’s leak-site claim rather than through a detailed official disclosure.

Who is lynx?

Lynx is a ransomware operation that became publicly visible in 2024. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also stealing data and threatening to publish it if payment is not made. Victims are routinely listed on a dedicated leak site, often with sample files or statements intended to pressure the organization. The group has been observed targeting a range of commercial entities across multiple sectors. Its listings constitute claims by the actors themselves; they do not automatically constitute independent verification that every asserted detail is accurate. In this case, the only specific assertion tied to Farrar & Ball is the listing itself and the description of exfiltrated internal files containing confidential client and company information.

About Farrar & Ball

Farrar & Ball is a well-known British manufacturer of premium paints, wallpapers, and related decorative products. The company serves both retail consumers and professional trade customers, including interior designers, architects, and contractors. Organizations of this type routinely maintain customer account records, order histories, contact details, payment-related information, supplier contracts, employee data, and internal commercial documents. A breach involving such material can therefore affect private individuals who have purchased products, trade partners who have shared project or billing data, and the company’s own workforce. Because the firm operates in a sector that handles both consumer and business relationships, the potential exposure of confidential client information carries consequences beyond the organization itself.

What was likely exposed

The facts state that internal files were exfiltrated and that the material comprises confidential information of clients and the company. No further breakdown of data types—such as specific categories of personal identifiers, financial records, or employee files—has been publicly confirmed. Organizations in the decorative-products and home-furnishings sector commonly hold names, addresses, email addresses, telephone numbers, purchase histories, trade-account details, and internal correspondence. Whether any of those categories were present in the files claimed by lynx has not been independently verified. The exact contents therefore remain unconfirmed, and any assessment of impact must rest on the limited description provided rather than on assumptions about particular data fields.

What's at stake

For individuals whose information may have been included, the principal risks are secondary misuse of personal or commercial details—such as targeted phishing, identity-related fraud, or unwanted contact. Trade clients could face exposure of project or billing information that competitors or fraudsters might attempt to exploit. For Farrar & Ball itself, the incident creates operational, reputational, and potential regulatory considerations, particularly if personal data of customers or staff is later shown to have been involved. Because the number of affected people is unknown and the precise data set is not publicly detailed, the scale of these risks cannot yet be quantified. The absence of confirmed numbers does not eliminate the need for caution; it simply means that any response should be measured and based on verified information as it becomes available.

Were you affected?

If you are a client, trade partner, or employee of Farrar & Ball, begin by monitoring account statements and communications for unusual activity. Enable multi-factor authentication on email and financial accounts where it is not already in place, and treat unsolicited messages that reference the company or recent purchases with heightened scrutiny. Change passwords for any services that may have shared credentials with company portals. Because public confirmation of specific individuals remains unavailable, a practical next step is to check whether your email address has appeared in previously known breach data sets. Free exposure-scan tools can perform this check without requiring payment and can help you decide whether further monitoring or credit-alert services are warranted. Continue to follow any official notices issued by Farrar & Ball for the most accurate guidance specific to this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.