Keller Polska Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Inside the incident

The incident came to light when the lynx group added Keller Polska to its leak-site listing. The only confirmed detail is that internal files were removed from the organisation’s systems during a ransomware attack. No information has been released on the date of the intrusion, the method of initial access, the duration of unauthorised presence, or whether any data was subsequently published. The scale of the exfiltration and the number of people whose information may be involved are both listed as unknown.

The group behind it: lynx

Lynx is a ransomware operation that follows the now-common pattern of encrypting systems and removing copies of data before demanding payment. The group maintains a public leak site where it lists organisations it claims to have compromised. Such listings are presented by the actors themselves and are not independently verified at the time they appear. Lynx has been observed targeting companies across multiple sectors in Europe and elsewhere, typically publicising the names of claimed victims to increase pressure during negotiations. In this case the group claims Keller Polska as a victim; no further statements from the organisation or from law-enforcement agencies confirming or disputing the claim have been made public.

Who is Keller Polska?

Keller Polska has operated for more than twenty years and describes itself as a leading provider of geotechnical services in Poland and the surrounding region. The company undertakes both small-scale local works and large infrastructure projects described as significant to the national economy. It forms part of the international Keller Group, which supplies additional financial resources, technical expertise and cross-border project capacity. Organisations in this sector routinely manage engineering designs, site investigation records, contractual documentation and operational data connected to construction and ground-engineering work.

What data was at risk

The only category named in available reports is “internal files exfiltrated in ransomware attack.” No inventory of file types, no count of records and no confirmation of personal data have been published. Companies of this kind commonly hold project plans, geotechnical test results, client correspondence, supplier contracts and internal administrative records. Whether any of these categories were among the files removed is not confirmed. Until a detailed disclosure is issued by Keller Polska or by investigators, the exact nature of the material remains unverified.

The real-world impact

Exposure of internal operational files can create practical difficulties for the affected organisation, including the need to review project documentation for integrity, reassess relationships with clients and suppliers, and strengthen access controls. For individuals whose information may appear in those files, the main concerns are potential misuse of contact details or contractual data. Because the volume and sensitivity of the material are still unknown, the extent of any downstream effects cannot yet be measured. The incident also places Keller Polska among the growing number of engineering and construction firms that have faced ransomware-related data removals in recent years.

If your data was in this claimed breach

Individuals who have worked with Keller Polska or its clients can begin by monitoring their email accounts and financial statements for unusual activity. Enabling multi-factor authentication on any accounts that may be referenced in project correspondence reduces the chance of credential misuse. A free exposure scan of an email address against known breach data sets can indicate whether the address has appeared in previously published collections, providing a starting point for further checks. Organisations should follow any official statements issued by Keller Polska for guidance specific to this incident.

AICompiled with AI assistance from public sources and published under our editorial standards.