On January 5, 2026, the Australian gold exploration company Regis Resources confirmed that its subsidiary McPhillamys Gold had been listed on the leak site of the lynx ransomware group. Internal files were allegedly exfiltrated during a ransomware attack, exposing data that could affect anyone whose personal or employment records were stored in those systems.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch mcphillamysgold.com
Get alerted the next time mcphillamysgold.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about mcphillamysgold.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the incident began when lynx gained access to McPhillamys Gold’s network, exfiltrated internal documents, and later published a sample on its dark-web leak page. The primary source is the lynx leak site itself, mirrored by ransomware.live at the onion address provided. No exact victim count has been released, and the precise volume or sensitivity of the stolen files remains unclear from available reporting. The listing appeared on January 5, 2026, consistent with the group’s typical pattern of publishing stolen data after an initial extortion window expires.
Why This Matters for You and Your Family
When a company that handles employment, vendor, or project records is breached, the information can include names, addresses, phone numbers, dates of birth, and financial details tied to real people. If you or a family member ever worked with Regis Resources, McPhillamys Gold, or any of its contractors, your data may now sit in a ransomware repository. Credential leaks like this one frequently cascade into account takeovers on other services where the same email and password were reused. Children’s accounts are not immune; many families link gaming logins to a parent’s email address that appears in corporate spreadsheets.
The Doxxing and Identity-Chain Implications
Ransomware operators rarely stop at dumping raw files. Once personal records surface, opportunistic criminals scrape them for email addresses, phone numbers, and usernames, then cross-reference those details across social media, gaming platforms, and data-broker sites. This creates an identity chain that can lead to doxxing, targeted phishing, or even physical harassment. A single leaked work email can expose your home address if it was stored alongside vendor or HR documents. Public reporting describes these chains as accelerating once initial data appears on leak sites, turning one corporate breach into months of follow-on risk for ordinary families.