Bounds Gillespie Killebrew Tushek Architects Listed by lynx Ransomware Group

On September 8, 2025, the architecture firm Bounds Gillespie Killebrew Tushek Architects appeared on the leak site of the lynx Ransomware Group, with internal files listed as exfiltrated during a ransomware attack.

What's Publicly Reported from Reporting

Public reporting indicates that the firm, known as BGKT Architects, had its internal documents stolen and published on the lynx leak site. The company was formed from a long-standing partnership that began with Paul Gillespie’s practice in 1977 and Danny Bounds joining in 1995. Art Killebrew joined the firm in 2011, bringing additional expertise in hospitality, mixed-use, institutional, and corporate projects.

Available reporting describes the exposed material as internal files. The exact number of people whose personal information appears in the files remains unknown. No specific deadline for payment or further data publication has been confirmed in the public leak listing.

Why This Matters for You and Your Family

When an architecture firm’s internal files are stolen, the information inside often includes contracts, client records, employee details, and correspondence that can contain names, addresses, phone numbers, email accounts, and financial references. If you or your family have ever worked with an architecture or design firm, hired one for a home renovation, or appeared in their project records, your information could be among the data now circulating among criminals.

Once stolen data leaves a company’s control, it rarely stays contained. It moves quickly into underground markets where it is combined with other leaks to build detailed profiles. For ordinary families this can mean sudden spikes in spam, phishing attempts, or more targeted fraud using real details from the files.

The Doxxing and Identity-Chain Implications

Stolen internal files frequently contain more than isolated records. They can link professional emails to personal phone numbers, home addresses to client names, and project notes that reveal family members or children involved in design projects. These connections allow attackers to map one piece of information to another, creating long identity chains that lead to doxxing.

Credential leaks like this one often cascade into account takeovers. A reused password found in an architectural firm’s files can give attackers access to your email, banking, or social media. When children’s names or school-related project details are included, their gaming accounts become easy targets because the same email or password may be used across family devices.

Lynx Ransomware Group’s Known Track Record

Public reporting attributes the attack to the lynx Ransomware Group. The group emerged in recent years and has targeted organizations across multiple sectors by gaining initial access, exfiltrating data, and then publishing samples on their leak site when victims do not pay. Their typical playbook combines ransomware encryption with public shaming through data leaks, a double-extortion style now common among ransomware operators.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup of exposed data.
• Rotate any password you used at the firm or similar design companies anywhere it has been reused, and switch on 2FA through an authenticator app instead of text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours rather than months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and credentials.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing your own accounts.

The incident shows how quickly professional data can become personal exposure. Taking concrete steps now limits how far attackers can travel along the identity chains they build from leaks like this one. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to close the gaps before the next breach appears.