Options Listed by lynx Ransomware Group

On December 31, 2025, the lynx Ransomware Group listed Options Community Services Society on its leak site, claiming that internal files had been exfiltrated from the British Columbia-based nonprofit. The organization, which provides Individual & Family Services and employs between 101 and 250 people, is headquartered in Surrey. Public reporting indicates that client and employee records may have been among the stolen data, although the exact number of people affected remains unknown.

Reported Details from Reporting

Available reporting describes the incident as a ransomware attack in which the threat actors gained access, exfiltrated files, and later published a listing on their dark-web leak page. The data exposed consists of internal documents rather than a single clearly defined database. No specific volume of records has been publicly quantified, and Options Community Services Society has not released a detailed notification as of the latest available information. The listing appeared on the final day of 2025, consistent with the group’s pattern of using end-of-year pressure tactics.

Why This Matters for You and Your Family

When a community services organization that supports families experiences a breach, the information stolen often includes names, addresses, dates of birth, contact details, and case notes that can be traced back to the people it serves. If your family has ever received counseling, financial aid, housing support, or child and family services from Options or a similar nonprofit, your personal data could now sit in an attacker’s archive. Credential leaks from such organizations frequently cascade into gaming accounts, email takeovers, and further identity theft because families often reuse passwords across personal and child-related services.

Children’s information is especially vulnerable. Gaming usernames, parent email addresses, and household phone numbers stored in family-service files can link directly to online profiles that predators or extortionists target. What begins as an organizational breach can quickly become a personal one that follows your family for years.

The Doxxing and Identity-Chain Risk

Ransomware operators rarely stop at dumping raw files. They map relationships between emails, usernames, phone numbers, and real-world identities to create saleable doxxing packages. A single leaked case file can expose the connection between a parent’s work email, a child’s Roblox or Minecraft username, and the family’s physical address. Once these links exist, opportunistic criminals can harass, impersonate, or extort family members. Public reporting on similar incidents shows that credential leaks from social-service providers often surface months later on multiple underground platforms, multiplying the exposure.

Lynx Ransomware Group Track Record

Public reporting attributes the group’s emergence to mid-2024. Lynx has since targeted hospitals, schools, nonprofits, and mid-sized service providers across North America. Notable prior victims include healthcare clinics and community support organizations whose client data carried high emotional and financial value. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by exfiltration of sensitive folders, and then dual extortion: demanding payment to prevent publication while threatening to notify affected clients directly. The group maintains a leak site that lists victims who do not pay, often adding countdown timers in the final weeks.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what can be taken down immediately.
• Rotate any password you ever used at Options Community Services Society or similar organizations, and enable two-factor authentication with an authenticator app everywhere that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next leak that touches your family is caught and acted on within hours rather than months.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same breached address or parent email.
• Let remediation specialists handle ongoing takedown requests across data brokers and leak sites while you focus on securing accounts at home.

The incident underscores a simple reality: data collected by the organizations that support your family can become ammunition for criminals. Acting quickly on the credentials and connections already exposed limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Starting protective measures now reduces the chance that this claimed breach becomes the first link in a longer campaign against you and your family.