Mark Thomas Listed by Lynx Ransomware Group

On October 15, 2024, civil engineering and land-surveying firm Mark Thomas & Company was listed on the leak site operated by the lynx Ransomware Group. The listing states that internal files were exfiltrated during a ransomware attack on the San Jose, California-based company, which was founded in 1927 and has worked on major California infrastructure projects for nearly a century. Anyone whose personal or professional data touched Mark Thomas systems may now be exposed.

Reported Details from the Listing

The lynx leak site entry, first observed on October 15, 2024, claims the attackers successfully stole internal files but does not specify the volume of data taken or name the exact file types. The disclosure indicates that Mark Thomas refused or failed to meet the group’s demands, prompting the public listing. No customer record count is provided, and the notification does not detail whether employee, client, or project-related documents were involved. Public reporting on lynx incidents shows this pattern is typical: the group posts a sample of allegedly stolen material and threatens full release if payment is not made.

Why This Matters for You and Your Family

If you or a family member ever worked with Mark Thomas & Company—whether as an employee, contractor, client, or project stakeholder—your information could sit inside the stolen files. Internal files from an engineering firm frequently contain names, addresses, dates of birth, Social Security numbers, driver’s license details, financial records, and project correspondence. Once such data leaves the company’s control, it can be sold quietly on underground forums long before any public announcement. For ordinary families this means sudden spikes in identity-theft attempts, loan fraud, tax-refund scams, or spear-phishing emails that look convincingly tied to California infrastructure projects you actually participated in.

The Doxxing and Identity-Chain Risk

Ransomware leaks rarely stop at one company. A single exposed email or phone number from the Mark Thomas files can be cross-referenced with gaming accounts, social-media handles, and data-broker records to build a complete identity chain. Attackers then target linked accounts for takeover, extortion, or doxxing. Children’s gaming usernames that reuse an exposed parent email are especially vulnerable; a compromise there can cascade into harassment or further personal data exposure. Credential leaks like this one routinely feed long-term identity abuse that surfaces months or years later.

Lynx Ransomware Group Track Record

Public reporting attributes the first significant activity by lynx Ransomware Group to mid-2024. The group has claimed responsibility for attacks on mid-sized engineering, manufacturing, and professional-services firms across the United States. Their typical playbook begins with initial access gained through phishing or exploited remote-desktop credentials, followed by rapid exfiltration of internal documents before encryption. Lynx then uses a double-extortion model: they demand payment to prevent both system restoration and public release of the stolen files. The October 15 Mark Thomas listing follows this pattern exactly, with the group publishing a teaser sample and setting a short deadline for payment.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, then use the cleanup to scrub what you can.
• Rotate any password you ever used at Mark Thomas anywhere it has been reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that chain back to the same address or parent email.
• Let remediation specialists handle takedown requests across data brokers and leak sites on your behalf while you focus on securing day-to-day accounts.

The Mark Thomas breach is a reminder that infrastructure and engineering firms hold sensitive personal data on thousands of ordinary families who never signed up to be part of a ransomware negotiation. Acting quickly on the credentials and identity chains exposed in this incident can limit the damage before it spreads further. Start your DoxxScan trial today and combine continuous monitoring, AI-powered identity-chain mapping, hands-on specialist remediation, and full household coverage—including children’s gaming accounts—to stay ahead of the next wave of leaks.