www.mcphillamysgold.com Listed by lynx Ransomware Group

On January 5, 2026, the Australian gold exploration company Regis Resources confirmed that its subsidiary McPhillamys Gold had been listed on the leak site of the lynx ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that could affect anyone whose personal or employment records were stored in those systems.

What's Publicly Reported from Reporting

Public reporting indicates the incident began when lynx gained access to McPhillamys Gold’s network, exfiltrated internal documents, and later published a sample on its dark-web leak page. The primary source is the lynx leak site itself, mirrored by ransomware.live at the onion address provided. No exact victim count has been released, and the precise volume or sensitivity of the stolen files remains unclear from available reporting. The listing appeared on January 5, 2026, consistent with the group’s typical pattern of publishing stolen data after an initial extortion window expires.

Why This Matters for You and Your Family

When a company that handles employment, vendor, or project records is breached, the information can include names, addresses, phone numbers, dates of birth, and financial details tied to real people. If you or a family member ever worked with Regis Resources, McPhillamys Gold, or any of its contractors, your data may now sit in a ransomware repository. Credential leaks like this one frequently cascade into account takeovers on other services where the same email and password were reused. Children’s accounts are not immune; many families link gaming logins to a parent’s email address that appears in corporate spreadsheets.

The Doxxing and Identity-Chain Implications

Ransomware operators rarely stop at dumping raw files. Once personal records surface, opportunistic criminals scrape them for email addresses, phone numbers, and usernames, then cross-reference those details across social media, gaming platforms, and data-broker sites. This creates an identity chain that can lead to doxxing, targeted phishing, or even physical harassment. A single leaked work email can expose your home address if it was stored alongside vendor or HR documents. Public reporting describes these chains as accelerating once initial data appears on leak sites, turning one corporate breach into months of follow-on risk for ordinary families.

Lynx Ransomware Group Track Record

Public reporting attributes the group’s emergence to mid-2024. Lynx has since listed dozens of organizations, focusing on mid-sized companies in mining, manufacturing, and professional services. Notable prior victims include other Australian and European firms whose internal documents were published after ransom demands went unpaid. Their typical playbook involves initial access through phishing or exploited remote desktop services, followed by quiet exfiltration, then dual extortion: demanding payment to prevent publication and offering a lower fee for “secure deletion.” When deadlines pass, samples are posted on their onion site with countdown timers for full data release.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate the password used at McPhillamys Gold or Regis Resources anywhere it is reused, and switch on 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak that touches your family is caught in hours, not months.
• Cover the household with DoxxScan family coverage that extends to dependents and children’s gaming accounts that often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests across data brokers and leak sites for you while you focus on securing day-to-day accounts.

The incident is a reminder that corporate breaches now reach deep into ordinary households. Taking concrete steps quickly can limit how far the stolen data travels. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, and hands-on remediation by specialists who manage takedowns for the entire family, including children’s gaming accounts vulnerable to credential-based takeovers.