Regis Resources Hit by Alleged Lynx Ransomware Attack, No Data Exfiltration Confirmed Regis Resources, a major unhedged gold producer based in Western Australia, is investigating a cybersecurity incident after the Lynx ransomware group listed its subsidiary, McPhillamys Gold, on its dark web leak site on 5 January. The threat actor included names and positions of key executives but provided no further details about the attack. Regis Resources confirmed the incident occurred in mid-November 2025, stating that its layered cybersecurity systems detected and contained the intrusion by temporarily shutting down affected systems. A forensic investigation found no evidence of data exfiltration or ransom demands, and the company reported no operational or commercial disruptions. Authorities were notified, though it remains unclear whether Lynx deployed ransomware or extracted any data. Lynx, a ransomware group active since July 2024, claims nearly 400 victims to date. In a July 2024 statement, the group asserted it avoids targeting government institutions, hospitals, and non-profits, framing its operations as "ethical" and favoring negotiation over destructive attacks. Regis Resources’ response underscores the growing threat of ransomware to industrial sectors, even as defenses improve.