salcom.com Listed by lynx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
salcom.com has been listed by the lynx ransomware group, with internal files reportedly taken; the incident was disclosed on January 05, 2026, though the actual date of the intrusion is not established. Anyone connected to the organisation should check for official notices and take protective steps if advised.
On January 05, 2026, salcom.com appeared on a listing attributed to the lynx ransomware group. The listing states that internal files were exfiltrated during a ransomware attack. The number of individuals affected remains unknown, and no further technical details or confirmation of the incident have been made public.
The available information is confined to the group’s claim and the company’s own description of its operations. No independent verification of the data volume, encryption status, or ransom demands has been released.
Breaking down the breach
The only confirmed public record is the listing itself. It asserts that files were taken from salcom.com systems but provides no dates of access, no description of the intrusion method, and no indication of whether data was encrypted or restored. The scale of the operation and any subsequent actions by the organisation are not disclosed in available records.
Who is lynx?
Public detail on the lynx group in relation to this specific incident is limited to the listing on its leak site. The entry presents salcom.com as a claimed victim of data exfiltration. No additional statements, timelines, or evidence from the group concerning this case have been published in the reported information.
salcom.com and its sector
Salcom.com states that its name stands for Sea Air and Land Communication. The company designs and manufactures radio communication hardware for marine, aeronautical and terrestrial use. It originated from Tait Communications in New Zealand and continues to employ several of that firm’s original engineers. The organisation reports nearly forty years of operation and exports to multiple countries.
Companies in this sector routinely handle technical specifications, product designs, customer configurations and supply-chain records. A claim of access to such material therefore touches on both commercial information and, potentially, details relevant to critical communications infrastructure.
What was likely exposed
The listing names only “internal files” as having been exfiltrated. No inventory of file types, no count of records, and no confirmation of personal data have been released. While organisations of this kind commonly store engineering documents, client correspondence and operational records, the precise contents of any exfiltrated material remain unconfirmed.
Why it matters
Exposure of internal technical files could affect the confidentiality of product designs and customer deployments. For individuals or partner organisations whose information appears in those files, the primary risks are loss of privacy and possible misuse of contact or configuration details. The organisation itself faces potential disruption to its engineering processes and client relationships until the scope of the incident is clarified.
If your data was in this claimed breach
Monitor accounts associated with salcom.com for unusual activity and change passwords where access credentials may have been stored. Enable multi-factor authentication on any linked services. Individuals can also run a free exposure scan of their email address against known breach data sets to check for further appearances of their information.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
ossistemes.com Listed by lynx Ransomware Groupsentrydynamics.com Listed by lynx Ransomware Groupwww.roschvisionary.com Listed by lynx Ransomware Groupwww.mscorp.net Listed by lynx Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the salcom.com Listed by lynx Ransomware Group →
Publicly posted by lynx — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.