Nactarome Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to list companies across manufacturing and food-supply sectors on dark-web leak sites, often after claiming to have stolen internal files. These postings form part of a broader pattern in which operators pressure organisations by threatening public release of data, even when independent confirmation of the intrusion remains limited.

On 9 July 2025 the ransomware group known as lynx listed Nactarome, an Italian developer of natural flavours and ingredients. Public detail is sparse: the number of people affected is unknown, and the only description of the material is that internal files were allegedly exfiltrated. The listing itself is a claim by the group; it has not been independently verified in the available record.

What happened

According to the reported summary, Nactarome was listed by the lynx ransomware group on 9 July 2025. The group asserts that internal files were exfiltrated during a ransomware attack. No further technical details—such as the initial access method, the precise date of the intrusion, the volume of data taken, or any ransom demand—have been disclosed in the public facts. The number of individuals whose information may have been involved remains unknown. Because the sole source is the group’s own leak-site claim, the incident should be treated as an unverified allegation until additional confirmation appears.

Who is lynx?

Lynx is a ransomware operation that became publicly visible in mid-2024. Like many contemporary groups, it typically employs a double-extortion model: encrypting systems while also copying data and threatening to publish it if payment is not made. The group has previously listed organisations in manufacturing, logistics and professional services, often posting sample files or directory listings to demonstrate possession of material. Its leak site functions as both a pressure tool and a public catalogue of claimed victims. No statements attributed specifically to lynx about Nactarome beyond the listing itself appear in the available facts; any broader claims about this particular incident therefore remain the group’s assertions rather than established fact.

About Nactarome

Nactarome was founded in 2018 and is headquartered in Bresso, Italy. The company develops and manufactures natural flavours, colours and functional ingredients, primarily serving the food and beverage markets. Organisations of this type routinely hold proprietary formulations, supplier and customer contracts, quality-control records, employee information and commercial correspondence. A breach affecting such a firm can therefore touch both commercial secrets and personal data of staff or business partners. Because Nactarome operates in the food-ingredient supply chain, any disruption or data exposure also carries potential implications for product integrity and regulatory compliance, even when the precise scope of the incident is still unconfirmed.

The information in question

The only data type named in the available facts is “internal files exfiltrated in ransomware attack.” No inventory of specific documents, databases or personal-data categories has been released. Companies that manufacture food ingredients typically maintain recipe and formulation files, batch records, supplier agreements, customer lists, financial documents and human-resources records. Whether any of those categories were among the files claimed by lynx is unconfirmed. Until more detail emerges, the exact contents of the material remain unknown, and it is not possible to state with certainty which individuals or partners may have been affected.

Why it matters

For people whose information may have been among the internal files, the practical risks include potential misuse of contact details, employment data or other personal identifiers that could facilitate phishing or identity fraud. For Nactarome itself, the exposure of proprietary formulations or commercial agreements could affect competitive position and contractual relationships. Even when the scale of an incident is unknown, the mere listing by a ransomware group can generate operational distraction, legal notification obligations and reputational questions. Because the number of affected individuals has not been disclosed, the full human impact cannot yet be measured; the absence of that figure itself underscores the need for caution rather than speculation.

If your data was in this claimed breach

If you have a past or present connection to Nactarome—as an employee, contractor, supplier or customer—consider practical steps: monitor financial and email accounts for unusual activity, enable multi-factor authentication where available, and treat unsolicited messages that reference the company with heightened scrutiny. Change passwords that may have been reused across work and personal systems. Because the precise data involved remain unconfirmed, these measures are precautionary rather than responses to verified exposure. Readers can also run a free exposure scan of their email address to check whether that address has already appeared in other known breach data sets; such a scan does not confirm involvement in this specific incident but can indicate whether the address is circulating more widely.

AICompiled with AI assistance from public sources and published under our editorial standards.