iBUYPOWER Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 20, 2025, the custom gaming PC maker iBUYPOWER was listed by the ransomware group known as lynx. Public reporting indicates that internal files were exfiltrated during a ransomware attack, though the number of people affected remains unknown and further details about the incident have not been disclosed.

The listing places the company among those claimed as victims by the group. For customers, partners, and employees of a firm that has built gaming systems since 1999, the development raises practical questions about what information may have left the organization and what steps those potentially affected can take.

What happened

According to available information, iBUYPOWER was listed by the lynx ransomware group on or around June 20, 2025. The reported summary states that internal files were exfiltrated in a ransomware attack. No public confirmation has been issued regarding the precise timing of the intrusion, the method of initial access, the volume of data taken, or whether systems were encrypted in addition to the exfiltration. The number of people affected is listed as unknown. Beyond the claim of internal-file exfiltration, the exact scope of the incident remains undisclosed.

The group behind it: lynx

Lynx is a ransomware operation that has appeared in public reporting as a group that conducts double-extortion attacks: data is stolen before systems are encrypted, and victims are pressured with the threat of publication on a dedicated leak site. Like other groups in this category, lynx typically posts victim names and sample claims on its site to increase leverage. Well-documented public accounts of the group describe it as operating in a manner consistent with other ransomware-as-a-service or affiliate models, though specific tooling and affiliate structures can vary over time.

In this case, the group claims iBUYPOWER as a victim through its leak-site listing. No independent verification of the full contents of any alleged dump has been provided in the available facts, and the listing itself should be treated as an unverified claim until corroborated by the organization or further forensic reporting.

iBUYPOWER and its sector

iBUYPOWER is a long-standing builder of custom gaming computers. Public descriptions of the company note that it has operated since 1999 with a focus on high-performance systems for enthusiasts, professional gamers, developers, LAN centers, esports events, and everyday consumers. It has collaborated with major hardware brands including Intel, NVIDIA, and AMD. Organizations of this type typically maintain customer order records, payment and shipping details, warranty and support histories, employee information, supplier contracts, and internal design or configuration data.

A ransomware incident affecting a company in the custom PC and gaming hardware sector is consequential because the firm sits at the intersection of consumer retail, component supply chains, and competitive gaming communities. Even limited internal-file exposure can affect trust among customers who have shared personal and financial details to purchase or configure systems, as well as among partners who exchange commercial information.

What was likely exposed

The facts name only “internal files exfiltrated in ransomware attack.” No further breakdown of file types, databases, or specific categories has been disclosed. Organizations that design, assemble, and sell custom gaming PCs commonly hold customer names, addresses, email addresses, phone numbers, order histories, payment-related records, support tickets, employee personnel data, and proprietary configuration or supplier documents. Because the exact contents remain unconfirmed, it is not possible to state which of these categories, if any, were among the files taken. Public detail is limited to the general claim of internal-file exfiltration.

Why it matters

For individuals whose information may have been present in internal systems, the primary risks are identity-related misuse, targeted phishing that references real order or support history, and potential financial fraud if payment or contact details were included. Even when the precise data set is unknown, the mere fact of an exfiltration claim can lead to increased social-engineering attempts against customers and staff. For the organization itself, the incident can disrupt operations, damage commercial relationships, and require costly investigation and notification work. Because the number of people affected is unknown, the full scale of individual impact cannot yet be measured.

In concrete terms, affected parties may face the ordinary but real burdens of monitoring accounts, updating credentials, and remaining alert for messages that appear to come from the company or its partners. The absence of confirmed counts or file inventories means any assessment of harm must remain provisional until more information is released.

What to do if you're exposed

If you have done business with iBUYPOWER or believe your details may have been stored in its systems, begin with basic hygiene: change passwords associated with any related accounts, enable multi-factor authentication where available, and monitor bank and credit statements for unexpected activity. Be cautious of unsolicited emails or calls that reference recent orders or support interactions, as these can be crafted from stolen data. Consider placing a fraud alert with credit bureaus if you have reason to believe financial identifiers were involved. Readers can also run a free exposure scan of their email address to check whether their information has already surfaced in known breach data sets. Official updates from the company, if and when they appear, should be treated as the primary source for confirmation of what was taken and who is affected.

AICompiled with AI assistance from public sources and published under our editorial standards.