Hyalogic Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People who have bought joint-care supplements, skin products or pet formulas from Hyalogic may now face uncertainty about whether personal or commercial information connected to those purchases has left the company’s control. On 16 April 2025 the organisation was listed by the ransomware group lynx, which claims to have taken internal files. The number of individuals affected remains unknown, and public detail about the precise contents of the material is limited, yet any exposure of customer, employee or partner records can create lasting practical risks.

What is confirmed so far is modest: a ransomware claim of data theft, a named company that sells premium hyaluronic-acid products, and an absence of further verified numbers or file inventories. That limited picture is still enough to warrant careful attention from anyone whose contact details, order history or related records might have been stored by the firm.

Inside the incident

According to the available record, Hyalogic was listed by the lynx ransomware group on 16 April 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No public confirmation of the attack method, the exact date of intrusion, the volume of data taken, or the number of people whose information may be involved has been released. The listing itself is a claim made by the group on its leak site; independent verification of the full extent of the incident has not been disclosed.

Because the facts stop at the assertion of exfiltrated internal files, it is not possible to state whether systems were encrypted, whether a ransom demand was issued, or whether any files have already been published. The absence of those details is itself part of the public record: scale, timing beyond the listing date, and technical method remain undisclosed.

Inside lynx

Lynx is a ransomware operation that has appeared in public reporting as a group that practises double extortion: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like other contemporary ransomware crews, it maintains a leak site on which it lists organisations it claims to have compromised, often posting samples or full archives to increase pressure. Public accounts of the group describe typical tactics that include initial access through phishing, exploitation of exposed remote services, or compromised credentials, followed by lateral movement, data staging and exfiltration before encryption is deployed.

Prior activity attributed to lynx has involved a range of mid-sized commercial and professional-services targets rather than only the largest enterprises. The group’s listings are claims; they do not by themselves prove that every named organisation suffered the full impact asserted. In the present case the only specific assertion tied to Hyalogic is the claim that internal files were taken. No further statements by the group about this victim—such as file counts, sample screenshots or ransom amounts—are part of the supplied facts and therefore cannot be treated as established.

Hyalogic and its sector

Hyalogic markets itself as a supplier of high-molecular-weight hyaluronic-acid products. Its range includes liquid oral supplements and lozenges for human joint care under names such as Synthovial Seven, topical skin-care lines under Episilk, and veterinary formulations for horses (Hyalun) and dogs or cats (HyaFlex). The company therefore operates at the intersection of dietary-supplement, personal-care and animal-health markets—sectors that routinely collect customer contact details, order histories, shipping addresses, payment-related information and, in some cases, health-related preferences or veterinary client records.

Organisations of this type also hold internal operational data: supplier contracts, inventory systems, employee records, research or formulation notes, and marketing lists. A breach involving internal files is consequential because the same systems that support product fulfilment and customer service often contain the personal identifiers needed for identity fraud, targeted phishing or competitive intelligence. Even when the precise files remain unconfirmed, the nature of the business makes clear why any unauthorised access to its repositories can affect both consumers and the firm’s commercial relationships.

What was likely exposed

The facts state only that internal files were exfiltrated in a ransomware attack. No inventory of those files, no count of records, and no list of data categories beyond the general description “internal files” has been disclosed. It is therefore not possible to assert that any particular type of personal information was taken.

Companies that sell consumer and veterinary supplements typically maintain customer databases containing names, email addresses, postal addresses, telephone numbers and purchase histories. They may also store employee personnel files, vendor contracts, product-formulation documents and financial records. Any of these categories could fall under the heading of internal files, yet none can be confirmed as present in the material claimed by lynx. The exact contents remain unconfirmed; readers should treat every specific data type as possible rather than proven.

What's at stake

For individuals, the principal risks are secondary misuse of contact or order information: phishing messages that appear to come from Hyalogic or its brands, attempts to reset accounts that reuse the same email address, or the quiet sale of address lists to other marketers. If payment-card data or government identifiers were present—an unconfirmed possibility—the risk would rise to financial fraud or identity theft. Because the number of people affected is unknown, the practical impact could range from a handful of records to a much larger set.

For the organisation the stakes include regulatory notification duties, potential contractual claims from partners or retailers, reputational damage among customers who value product safety and privacy, and the operational cost of investigating and remediating whatever systems were compromised. Even without confirmed publication of the files, the mere claim of exfiltration can erode trust and invite further scrutiny from regulators and customers alike.

If your data was in this claimed breach

If you have ever purchased from Hyalogic or shared personal details with the company, treat the incident as a prompt for basic hygiene rather than panic. Change passwords on any accounts that reuse the same credentials you may have used with the firm, enable multi-factor authentication wherever it is offered, and watch bank and credit statements for unfamiliar charges. Be sceptical of unsolicited emails or calls that reference your past orders or claim to be from Hyalogic support; verify any such contact through official channels you already trust.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so will not confirm or rule out involvement in this specific incident, but it can show whether your information is circulating more widely and help you prioritise further protective steps.

AICompiled with AI assistance from public sources and published under our editorial standards.